log4j-scanner - log4j-scanner is a project derived from other memb

项目说明

Log4j Scanner #

This repo is archived as of 6 Dec 2022 - and is no longer being maintained.

This repository provides a scanning solution for the log4j Remote Code Execution (C & C).
The information and code in this repository is provided "as is" and was assembled with the help of the open-source community and updated by CISA through collaboration with the broader cybersecurity community. This is not intended to be a 100% true positi; False negatives may occur.

Official CISA Guidance & Resources ##

CISA Apache Log4j Guidance

Statement from CISA Director Easterly on “Log4j” .

CISA Current Activity Alerts ##

Apache Releases Log4j 2.15.0 to Address Critical RCE Under Exploitation

CISA Creates Webpage for Apache Log4j C

C & C ##

Steps to test ###

<details><summary>Configure your own DNS Server - Preferred) </summary><br/>

Add DNS records to your domain. (example.com)

A record with a value of your IP address (test.example.com -> <PUBLIC IP ADDRESS>)

NS record (ns1.example.com) with a value of the test.example.com as chosen above.

Host a DNS server to log DNS requests made to your domain.

Install the requirement modules -> pip3 install -r requirements.txt

Modify the dns/ddnsserver.py script with the value of the NS record above (test.example.com)

python3 ddnsserver.py --port 53 --udp >> dns-results.txt

Test it with nslookup hello.test.example.com. You can run tail -f dns-results.txt to monitor these logs.

You should see the entry in your dns-results.txt file after the nslookup command. Once you do, you're ready to scan!

Note: Same concepts will apply if you're using internal DNS to test this.

</details>

<details><summary>DNS pro - (Interact.sh or canarytokens.org) </summary><br/>

Interact.sh - Interactsh is an open-source solution for out-of-band data extraction. It is a tool designed to detect bugs that cause external interactions. These bugs include, Blind SQLi, Blind CMDi, SSRF, etc.

Canarytokens.org - Canarytokens helps track activity and actions on your network.

</details>

<details><summary>LDAP Server (OPTIONAL)</summary><br/>

Reference the README.md under the ldap directory if you'd also like to test a running LDAP server.

Build the project using maven. cd ldap

m package -DskipTests

nohup java -cp target/marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer " 443 >> ldap_requests.txt &

There are alternatives to this project as well.

</details>

<details><summary>HTTP Service Discovery & Scanning</summary><br/>

Gather your most update-to-date asset list of your organization and find web services. Though this does not solely affect web services,

this will serve as a great starting point to minimizing the attack surface.

If you have a list of company owned URLS, you may skip this step: Utilize some well known tools like httpprobe or httpx to identify web services running on multiple ports. Basic Example: httpprobe -> cat list-of-your-company-domains.txt | $HOME/go/bin/httprobe > your-web-assets.txt

Now that you have a list of URLs, you're ready to scan: python3 log4j-scan.py --run-all-tests --custom-dns-callback-host test.example.com -l web-asset-urls.txt

Be sure to scan for the new CVE as well -> python3 log4j-scan.py --test-C --custom-dns-callback-host test.example.com -l web-asset-urls.txt

Monitor the DNS ser in Step 2.

</details>

CREDITS ##

As many in industry, we did not feel the need to "re-invent the wheel". This
recommended scanning solution is derived from the great work of others (with slight modifications). We' two additional
projects to avoid using third-parties.

log4-scanner - Log4j scanning framework. Thank you to the .io team.

dns - Simple DNS server (UDP and TCP) in Python. Thank you & .

ldap - Contains useful code to test the lookup() call. Thank you

Issues ##

If you ha using the code, open an issue on the repository!

You can do this by clicking "Issues" at the top and clicking "New Issue" on the following page.

Contributing ##

We welcome contributions! Please see here for details.

Disclaimers ##

There are likely additional, as yet unknown ways to le these (C & C) . CISA is staying across

multiple platforms (blog posts, repos, tweets, etc.) to stay up-to-date as the log4j situation unfolds and progresses.

This repository will focus solely on pro tooling to help organizations look for a limited set of currently known in assets owned by their organization.

For CISA's official guidance on these , please follow this repository.

License ##

The following attributions are referenced and/or deri works distributed with this source:

log4j_scanner Copyright 2021 Mazin Ahmed

Ja Security Copyright 2021 Moritz Bechler

MIT License Applicable to Original log4j_scanner and Ja Security Works: Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The abo notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Simple DNS Ser 2021 Andrei Fokau

Licensed under the Apache License, 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at:

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language go permissions and limitations under the License.

Any and all changes applied by CISA are in the public domain.

Legal Disclaimer ##

NOTICE

USE THIS SOFTWARE AT YOUR OWN RISK. THIS SOFTWARE COMES WITH NO WARRANTY, EITHER EXPRESS OR IMPLIED. THE UNITED STATES GO ASSUMES NO LIABILITY FOR THE USE OR MISUSE OF THIS SOFTWARE OR ITS DERI.

THIS SOFTWARE IS OFFERED “AS-IS.” THE UNITED STATES GO WILL NOT INSTALL, REMO OR SUPPORT THIS SOFTWARE AT YOUR REQUEST. IF YOU ARE UNSURE OF HOW THIS SOFTWARE WILL INTERACT WITH YOUR SYSTEM, DO NOT USE IT.

NO ENDORSEMENT ##

CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply their endorsement, recommendation, or fa by CISA.

项目信息

开发语言：Java

Star 数：1277

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕log4j-scanner is a project derived from other members of the open-source community by CISA to help organizations identify potentially vulnerable web services affected by the log4j vulnerabilities. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。