ziCreaMz

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

Security Advisories / Bulletins linked to Log4Shell (CVE-2021-44228)

If you want to add a link, comment or send it to me
Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

	<#

	DynWin32-ReverseShell.ps1 is a reverse shell based on dynamically looked up Win32 API calls.
	The script uses reflection to obtain access to GetModuleHandle, GetProcAddress and CreateProcess.
	Afterwards it uses GetModuleHandle and GetProcAddress to resolve the required WSA functions
	from ws2_32.dll.

	This script should be used for educational purposes only (and maybe while playing CTF :D).
	It was only tested on Windows 10 (x64) and is probably not stable or portable. It's only
	purpose is to demonstrate the usage of reflective lookups of Win32 API calls. See it as

	import json
	import logging
	import requests
	import sys
	import time

	from base64 import b64encode

	logging.basicConfig(filename='sumo-search-job.log', level='INFO', format='%(asctime)s %(levelname)s: %(message)s')
	logging.info('***********STARTING REQUEST***********')