Static detection of vulnerable log4j librairies on Windows members of an AD domain. Uses detection tool binary provided by @1lann : https://github.com/1lann/log4shelldetect
- Administrator privileges on targeted computers.
- Active Directory PowerShell module.
- WindowsManagementFramwork 5.1 (PS 5.1) on targeted computers.
The script starts by creating a .csv list of your domain-joined servers, in the script folder. Just run it, if that file doesn't exist yet, it will ask you for create it.
./log4shelldetect.ps1
You can use a search pattern to fulfill that list and target specific servers names. That pattern will be added to the "Get-AdComputer -Filter". Example:
./log4shelldetect.ps1 -searchPattern '*tst*'
Simply launch the script without arguments. It will create PSJob foreach entries in the server list. These PSJobs will create scheduled tasks remotely on every AD computer targeted, for each local drive detected. Then, the scan binary will be executed to scan the filesystem, searching for vulnerable libraries.
./log4shelldetect.ps1
Finally, you need to retrieve the job outputs to update the server list with status (vulnerable, not vulnerable, not reachable...) If the server is detected vulnerable, a folder named with the concerned machine name will be created in the current folder, containing the output of the scan tool. Each line of these text files represent a vulnerable log4j binary.
./log4shelldetect.ps1 -update
Be careful with automation !
The scheduled tasks runs as 'NT AUTHORITY\SYSTEM' to access every directories on the local filesystem.
Use at your owns risks. Do not hesitate to review the script before using it.
Special thanks for @1lann work, for his early development of an effective tool to detect log4j vulnerabilities.