logging-log4j1
marshalsec
| logging-log4j1 | marshalsec | |
|---|---|---|
| 5 | 7 | |
| 872 | 3,211 | |
| - | - | |
| 0.0 | 0.0 | |
| over 1 year ago | over 1 year ago | |
| Java | Java | |
| Apache License 2.0 | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
logging-log4j1
-
CrowdSec is now able to detect and mitigate log4j CVE-2021-44228
a check against all repos listed under https://github.com/apache/log4j/network/dependents is more effective in finding all effected.
-
Zero-Day RCE Vulnerability CVE-2021-44228 aka Log4Shell: What We Know So Far
why not try testing against all repos listed here: https://github.com/apache/log4j/network/dependents ?
- 2021-12-10 - Cool Query Friday - Hunting Apache Log4j CVE-2021-44228 (Log4Shell)
- Log4j RCE Found
marshalsec
-
How do I construct a curl command for a log4shell ldap server?
I'm using this: https://github.com/mbechler/marshalsec as an LDAP server.
-
A Study Notes of Exploit Spring Boot Actuator
According to the introduction in https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf, in addition to the javax.script.ScriptEngineManager class , we can also use the com.sun.rowset.JdbcRowSetImplclass to complete the exploitation through JNDI injection. The payload is as follows
-
Log4Shell log4j vulnerability (CVE-2021-44228) - cheat-sheet reference guide
Not sure if that method actually works since LDAP is a different protocol than HTTP? If you're running an HTTP server as the receiver, then your server is just going to be confused by the connection and it might not log anything. You either want to run an LDAP server like https://github.com/mbechler/marshalsec , or have some logging method that triggers on any TCP connection, or use a service like dnslog.cn that can log for you. (although I've seen a lot of companies are now specifically blocking that domain which seems silly).
- GitHub taking down tools allowing defenders to reproduce the Log4j vulnerability
- WTH
- Java Unmarshaller Security – Turning your data into code execution
- Log4j RCE Found
What are some alternatives?
Apache Log4j 2 - Apache Log4j 2 is a versatile, feature-rich, efficient logging API and backend for Java.
Java-Deserialization-Cheat-Sheet - The cheat sheet about Java Deserialization vulnerabilities
tsunami-security-scanner - Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.
Logback - The reliable, generic, fast and flexible logging framework for Java.
JNDIExploit - 一款用于JNDI注入利用的工具，大量参考/引用了Rogue JNDI项目的代码，支持直接植入内存shell，并集成了常见的bypass 高版本JDK的方式，适用于与自动化工具配合使用。
semgrep - Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
jdk8u - https://wiki.openjdk.org/display/jdk8u
GHSA-jfh8-c2jp-5v3q
lunasec - LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/
log4j_CVE-2021-44228_tester - Multithreaded log4j vulnerability scanner using only bash! Tests all JNDI protocols, HTTP GET/POST, and 84 headers. [Moved to: https://github.com/ssstonebraker/log4j-scan-turbo]
rogue-jndi - A malicious LDAP server for JNDI injection attacks