https://www.kimobu.space/tags/purpleteam/Recent content in Purpleteam on kimobuHugoen-usCopyright Kimo BFri, 10 Dec 2021 00:00:00 +0000https://www.kimobu.space/posts/log4j-JDNI-Exploitation/Fri, 10 Dec 2021 00:00:00 +0000https://www.kimobu.space/posts/log4j-JDNI-Exploitation/<h1 id="situation">Situation</h1> <p>A <a href="https://www.lunasec.io/docs/blog/log4j-zero-day/">remote code execution (RCE) bug was found in log4j</a>. <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-44228">CVE 2021-44228</a> has been assigned to it. The vulnerability lies in how log4j interprets Java Naming and Directory Interface (JNDI) URLs. JNDI lets an application look up a service. An attacker can craft a string that looks like &ldquo;${jndi:proto://host/a}&rdquo; where <code>proto</code> is ldap or rmi, and log4j will connect to the <code>host</code> to retrieve <code>a</code>, which would specify how to process the log entry. However, <code>a</code> can instead provide Java bytecode that log4j will execute.</p>