Identify all log4j components on a single local windows servers. CVE-2021-44228. A single use copy - see https://github.com/KeysAU/Get-log4j-Windows.ps1 for multi computer.
Columns A - I:
Continued:
Local run version for a single server.
Sets up working directory C:\Temp\log4j on local server.
Recursevly scans all drives for .jar containers.
Extracts all .jar with 7-zip.exe to C:\temp\log4j\Extracted
Gets version number of log4j version.
Checks if log4j jindiLookup.class file exists of log4j version.
Scans all local listening IP ports and attempts to exploit with http header.
Captures failed ps jobs, and closes stuck jobs.
Dynamically creates csv of where embedded log4j module was located,
if web exploitation was possible and if contains jindilookup.class file.
Identifying all log4j components on local windows server. CVE-2021-44228
You must install 7-zip.exe in C:\support\tools\7-zip on the local server (x32 bit suggested)
PowerShell 5.0+
Must run as a local admin or equivalent permissions to scan all drives
15-Dec-2021 -Change Notes: Initial local copy version.
19-Dec-2021 -Change Notes: Added scanning for jindiLookup.class
19-Dec-2021 -Change Notes: Added local listening port scan and exploitation attempt
No modification, will out out of the box. Note you still need 7zip.
Open-sourced software licensed under the MIT license.
Keith Waterman
19-Dec-2021