Apache Log4j2 Jndi RCE

#1

Post by CodeHz » Thu, Dec 09, 2021, 4:55 PM UTC

Re: Apache Log4j2 Jndi RCE

#2

Post by CodeHz » Thu, Dec 09, 2021, 5:00 PM UTC

Tested on: Steam (search box), Apple (icloud), Minecraft (both server and client, just type PoC in chat box) (Tip: use dnslog to test(no payload), so it should not cause any problems)

Re: Apache Log4j2 Jndi RCE

#3

Post by [deleted] » Fri, Dec 10, 2021, 4:36 AM UTC

CodeHz wrote: post #2

Tested on: Steam (search box), Apple (icloud), Minecraft (both server and client, just type PoC in chat box) (Tip: use dnslog to test(no payload), so it should not cause any problems)

[deleted]

Re: Apache Log4j2 Jndi RCE

#4

Post by [deleted] » Fri, Dec 10, 2021, 4:37 AM UTC

CodeHz wrote: post #2

Tested on: Steam (search box), Apple (icloud), Minecraft (both server and client, just type PoC in chat box) (Tip: use dnslog to test(no payload), so it should not cause any problems)

[deleted]

Re: Apache Log4j2 Jndi RCE

#5

Post by [deleted] » Fri, Dec 10, 2021, 9:32 AM UTC

CodeHz wrote: post #2

Tested on: Steam (search box), Apple (icloud), Minecraft (both server and client, just type PoC in chat box) (Tip: use dnslog to test(no payload), so it should not cause any problems)

[deleted]

Re: Apache Log4j2 Jndi RCE

#6

Post by CoderHY » Fri, Dec 10, 2021, 3:23 PM UTC

CodeHz wrote: post #2

Tested on: Steam (search box), Apple (icloud), Minecraft (both server and client, just type PoC in chat box) (Tip: use dnslog to test(no payload), so it should not cause any problems)

Just tested and I can confirm it also works on samsung cloud storage and all Naugthy dog games. This is going to be big.

(also could not reproduce on iCloud, what url did you use?)

Re: Apache Log4j2 Jndi RCE

#7

Post by Fabiolino » Fri, Dec 10, 2021, 3:36 PM UTC

Tested on google photo using dnslog, confirm it is working there too

Re: Apache Log4j2 Jndi RCE

#8

Post by [deleted] » Sat, Dec 11, 2021, 4:30 AM UTC

[deleted]

Re: Apache Log4j2 Jndi RCE

#9

Post by [deleted] » Sat, Dec 11, 2021, 4:54 AM UTC

[deleted]

Re: Apache Log4j2 Jndi RCE

#10

Post by [deleted] » Sat, Dec 11, 2021, 5:37 AM UTC

CodeHz wrote: post #2

Tested on: Steam (search box), Apple (icloud), Minecraft (both server and client, just type PoC in chat box) (Tip: use dnslog to test(no payload), so it should not cause any problems)

[deleted]