Skip to content

Instantly share code, notes, and snippets.

@ldaume

ldaume/find-log4j-debian.sh

Forked from perryflynn/find-log4j-debian.sh
Created December 13, 2021 08:40
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save ldaume/1c149c3b388921f2a8adb70c7825d6ee to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save ldaume/1c149c3b388921f2a8adb70c7825d6ee to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @perryflynn perryflynn revised this gist Dec 12, 2021. No changes.
  2. @perryflynn perryflynn revised this gist Dec 12, 2021. 1 changed file with 3 additions and 0 deletions.
    3 changes: 3 additions & 0 deletions find-log4j-debian.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -3,6 +3,9 @@
    # Finds log4j resources on Linux (tested with Debian)
    # by Christian Blechert <[email protected]>

    # ATTENTION! It only checks ext3 + ext4 filesystems right now!
    # Extend it if you use something else

    while read -u 3 -r JAR
    do

  3. @perryflynn perryflynn revised this gist Dec 12, 2021. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion find-log4j-windows.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -5,7 +5,7 @@ Add-Type -assembly "system.io.compression.filesystem"

    gwmi win32_volume | where-object { $_.filesystem -match "ntfs" -and $_.name -match "^[A-Z]:" } | sort { $_.name } | foreach-object {

    Get-ChildItem "C:\Program Files\NetBeans 8.2" -File -Recurse -erroraction 'silentlycontinue' |
    Get-ChildItem $_.name -File -Recurse -erroraction 'silentlycontinue' |
    Where-Object { $_.Name -match '\.jar$' } |
    Select-Object -ExpandProperty FullName |
    Foreach-Object {
  4. @perryflynn perryflynn created this gist Dec 12, 2021.
    21 changes: 21 additions & 0 deletions find-log4j-debian.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,21 @@
    #!/bin/bash

    # Finds log4j resources on Linux (tested with Debian)
    # by Christian Blechert <[email protected]>

    while read -u 3 -r JAR
    do

    JAR=$(echo "$JAR" | tr -d '[:space:]')

    if [ -z "$JAR" ]; then
    continue
    fi

    NUM=$(unzip -l "$JAR" | grep -P "^\s+[0-9]+\s+[0-9-]+\s+[0-9:]+\s+.+" | awk '{print $4}' | grep -P 'org/apache/(log4j|logging/log4j)' | wc -l)

    if [ $NUM -gt 0 ]; then
    echo "$JAR"
    fi

    done 3<<< "$(find / \( -fstype ext4 -or -fstype ext3 \) -type f -name "*.jar" 2> /dev/null)"
    34 changes: 34 additions & 0 deletions find-log4j-docker.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,34 @@
    #!/bin/bash

    # Finds log4j resources in running docker containers
    # by Christian Blechert <[email protected]>

    while read -r CONTAINER
    do

    CONTAINER=$(echo "$CONTAINER" | tr -d '[:space:]')

    if [ -z "$CONTAINER" ]; then
    continue
    fi

    while read -u 3 -r JAR
    do

    JAR=$(echo "$JAR" | tr -d '[:space:]')

    if [ -z "$JAR" ]; then
    continue
    fi

    rm -f moep.jar
    docker cp "$CONTAINER:$JAR" moep.jar
    NUM=$(unzip -l moep.jar | grep -P "^\s+[0-9]+\s+[0-9-]+\s+[0-9:]+\s+.+" | awk '{print $4}' | grep -P 'org/apache/(log4j|logging/log4j)' | wc -l)

    if [ $NUM -gt 0 ]; then
    echo "$CONTAINER @ $JAR"
    fi

    done 3<<< "$(docker exec -u root $CONTAINER find / -type f -name "*.jar" 2> /dev/null)"

    done <<< "$(docker ps --format '{{.Names}}')"
    21 changes: 21 additions & 0 deletions find-log4j-windows.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,21 @@
    # Finds log4j resources on Windows machines
    # by Christian Blechert <[email protected]>

    Add-Type -assembly "system.io.compression.filesystem"

    gwmi win32_volume | where-object { $_.filesystem -match "ntfs" -and $_.name -match "^[A-Z]:" } | sort { $_.name } | foreach-object {

    Get-ChildItem "C:\Program Files\NetBeans 8.2" -File -Recurse -erroraction 'silentlycontinue' |
    Where-Object { $_.Name -match '\.jar$' } |
    Select-Object -ExpandProperty FullName |
    Foreach-Object {
    $folder = $_
    $containsLog = ([io.compression.zipfile]::OpenRead($folder).Entries |
    Where-Object { $_.FullName -match "^org/apache/(log4j|logging/log4j)" }).Length

    if ( $containsLog -gt 0 ) {
    Write-Host "$($folder)"
    }
    }

    }