log4j-shell-poc - A Proof-Of-Concept for the CVE-2021-44228 vulnerab

项目说明

log4j-shell-poc

A Proof-Of-Concept for the recently found C . <br><br>
Recently there was a new in log4j, a ja library that is very widely used in the likes of elasticsearch, minecraft and numerous others.

In this repository there is an example application and proof-of-concept (POC) exploit of it.

Proof-of-concept (POC)
----------------------

As a PoC there is a python file that automates the process.

#### Requirements:

#### Usage:

* Start a netcat listener to accept reverse shell connection.<br>

* Launch the exploit.<br>
Note: For this to work, the extracted ja has to be named: jdk1.8.0_20, and be in the same directory.

This script will setup the HTTP server and the LDAP server for you, and it will also create the payload that you can use to paste into the parameter. After this, if e went well, you should get a shell on the lport.

<br>

application
--------------------------

There is a Dockerfile with the webapp. You can use this by following the steps below:

Once it is running, you can access it on localhost:8080

<br>

Getting the Ja.
--------------------------------------

Oracle thankfully provides an archive for all previous ja:<br>

Scroll down to 8u20 and download the appropriate files for your operating system and hardware.
!Screenshot from 2021-12-11 00-09-25

Note: You do need to make an account to be able to download the package.

Once you ha and extracted the archive, you can find java and a few related binaries in jdk1.8.0_20/bin.<br>
Note: Make sure to extract the jdk folder into this repository with the same name in order for it to work.

Disclaimer
----------
This repository is not intended to be a one-click exploit to C. The purpose of this project is to help people learn about this , and perhaps test their own applications (howe are better applications for this purpose, ei: ).

项目信息

开发语言：Python

Star 数：1846

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A Proof-Of-Concept for the CVE-2021-44228 vulnerability. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。