• Home
  • Attack
  • Dataset
  • Contact Us
        • T1-24–01–S–N–CL
        • T2-24–01–S–N–CL
        • T3-24–01–S–N–CL
        • T4-24–01–S–E–M
        • T5-24–01–S–E–LM
        • T6-24–01–S–E–FH
        • T7-24–01–M–NE–CLM
        • T8-24–01–M–NE–CFHL
        • T9-24–01–M–NE–CLM
        • T1-24–02–S–N–CIKM
        • T2-24–02–S–N–CL
        • T3-24–02–S–N–CL
        • T4-24-02-S-E-M
        • T5-24-02-S-E-DL
        • T6-24-02-S-E-DEGN
        • T7-24-02-M-NE-CDEGLN
        • T8-24-02-M-NE-CDL
        • T9-24-02-M-NE-CLH
  • T1-24–01–S–N–CL

  • Apache Log4Shell (CVE-2021-44228)

    Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

    •  


  • OS IP Software Log collection
    time    		 Program
    runtime
    Attacker Ubuntu 22.04.2 172.17.0.1 jdk-8u20-linux-x64 18 sec 30 sec
    Victim (docker) Ubuntu 22.04.2 172.17.0.2 log4j 2.17.0

  • Installing
  • python3 -m pip install -r requirements.txt
    cd resource
    tar -zxvf jdk-8u20-linux-x64.tar.gz
    cd ..

  • Using
  • sudo docker load -i T1-24-01-S-N-CL.tar
    python3 run.py [-t, --time], [-f, --file]

    optional arguments:
    -t, --time Specify a time to collect logs
    -f, --file PoC file path, default path ./poc.py

  • MITRE ATT&CK Framework
  • Attack Tactic
    Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion
    Credential Discovery Lateral Movement Collection Command and Control Exfiltration Impact

  • Logs
  • ./log/2024_01_T1_{time}.pcap # YYmmdd_HHMMSS


  • References
  • [1] NIST CVE-2021-44228
    [2] Trendmicro Apache Log4J(Log4Shell) 취약점이란?
    [3] Ahnlab ASEC [안내] Apache Log4j 취약점 CVE-2021-44228 영향을 받는 Log4j Core
    [4] Paloalto Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021-44228) (Updated)
    [5] SK쉴더스 [Research & Technique] Log4Shell 취약점(CVE-2021-44228)

  • ※ Click on the attack name to see a description and scenario for the attack
    • 2024 01
    • T1-24–01–S–N–CL
    • T2-24–01–S–N–CL
    • T3-24–01–S–N–CL
    • T4-24–01–S–E–M
    • T5-24–01–S–E–LM
    • T6-24–01–S–E–FH
    • T7-24–01–M–NE–CLM
    • T8-24–01–M–NE–CFHL
    • T9-24–01–M–NE–CLM
  • Copyright(C) 2024, KAIST Cyber Security Reserch Center. All Rights Reserved.