and this is the last log for j talk
you'll ever need
so a bit about who i am and what do i do
i code i teach i hack in other words i
spend
most of my days on work and off bashing
my head against the keyboard and the
absence base either to get code to work
or to break other people's code and in
that concussive stupor i also try to
stand behind a podium stage whatever and
give insights on my experiences to
everyone else
i do i must add the disclaimer although
i do have an employer currently
i do not speak for the corporate hive
mind
i am just one of its many cogs
so
moving on to what we talking about
on your left you see one of the most
popular logging libraries in java and on
the right you see your ticket to shelves
and it's all about a pocket gaining a
pocket full of shells
and do
take note of the cve don't get it
confused with any of the other ones
like for example cv45046
or any of the
others they're nice they're good
they're ex they're they're
ways of exploiting systems but the
problem is
they require
effort
and that's not what we come here for for
log for shell log for shell isn't about
effort and insight it's about getting
arbitrary remote code execution
anywhere and everywhere and so
if you want to see the magical payload
of what
it takes actually exploit log for shell
here it is
it is just the jndi
ldap
at the location via the ip and the port
and the path to the exploit
and let's just
take a deep dive and look in through it
unlike most acronyms in it
ldap and jdi are actually useful for
explaining
what they are
so
ldap you'll see tutorials classes
seminars everywhere about that
the long and short of it is
ldap a lightweight directory access
protocol
is just
file operations over tcp
that's just using
internet web requests how do you move
files delete files create and edit files
so your basic file operations that you
find in the desktop how do you do it
online do the same thing online
and the jdi is just the java name
directory interface
and so
why why do you need to use jndi why
would anyone use jdi in the first place
is because
of code reusability is the number one so
in each new project you don't want to
define basic things like shared
libraries or database connections
configurations templates or
for example setting where which logging
server
which logging server
you want to use you kind of want to have
that code easily be reused
throughout multiple projects and the
combination of these two both ldap and
jdi helps facilitate that functionality
and so
just uh
dive deeper into the weeds
ldap is the number one provider for uh
the ngmdis
which is just um
it
so you've got your java application
globally and then
the jndi api and the naming manager and
one of the best ways to explain the use
case of jndi is
dns
so remember
in dns you don't memorize series
uh series of octets
and just route to them
manually through your browser what you
do instead is you use a human friendly
identifier like a hostname so it's
defcon.org
google.com etc
and then
the pr the service of dns
routes
the human friendly identif human
friendly name
to the machine readable
and it's the same thing with jndi
you don't always know the exact path of
classes and objects
within the code base
so
jndi is really useful for
designating
designating that class path
and if you go through
oracle documentation for java 7 and java
8
the ldap is just the number one provider
here and so
it's one of the most basic and most
common use cases for doing something
like that reusing the same code and
libraries throughout the projects
now we go on to the kill chain so
log for in this is for log first shell
specifically you either spin up your own
local ldap server or you take over
someone else's
then you do anything within the context
of the app that will cause it to log
this could include
this can include just
modifying the body of a post request
but most often what you'll see in the
wild is just modifying the header a
header that most all that almost always
gets logged is the user agent
and so when log for jpa went out most
like if you wanted
to walk around the internet and get
random shells everywhere
from everywhere all you had to do was
just change the user agent to a local
ldap server or one hosted remotely that
you owned and bam
you would get arbitrary connections
so
the la the rest of the kill chain is
that the app will
that are that just by including the
payload
because the ldap
because the ldap server is automatically
trusted
uh the app will reach out to that server
the server will send a jndi response
including the class and then
within that class
you can inject into the process and get
remote code execution from there
yeah kill chain
um
so
to facilitate this and make this a lot
easier
set up a home lab in minecraft
so it is built on vagrant
using ubuntu
and
because ubuntu and of course
uh one of the most popular java
applications out there there is a number
of benefits on why
this particular architecture than others
namely
i don't have to code java
getting things to com i've spent
like days and weeks of my life trying to
get things to compile with maven and
gradle and i don't want to do that i
promise you i promise you i'm a
developer it's just for this particular
project
i'm just going to
use ruby and by ruby i mean just enough
ruby to get some bash scripts in there
a few works cited um this all of these
exploit kits are available at github
so
uh
the
one these exploit that kit we're going
to use is the faehon cs
exploit that actually was taken down by
who knows who uh but we
but one of the benefits of that is that
we can
find this sketchy exploit kit through
the wayback machine that use it within
our vm
there are other exploit kits for there
are plenty of exploit kits for
the
log for shell vulnerability
most of these are just hey
they'll automate and streamline the
process of standing up your own
jnd
jndi compatible ldap server
uh shout out to
da667 on twitter uh
ice
mainly for the
minecraft version and the java version
which is very important
java for this project i'm using open jdk
1.8.0
and
making sure that the patch level is
before
121 because from then onward arbitrary
class loading is disabled by default
so you not only have to have a
vulnerable version
a vulnerable java application
you have to have
the vulnerable java runtime
vulnerable log4j
and for this particular project
m for this particular project a
vulnerable version of minecraft because
as mojang has discovered these things
it
it's gotten to the point where
the
basic
date time formatting that you normally
were able to do in within the chat which
is the dollar sign curly bracket
date time it's gotten to the point where
players are no longer to execute basic
things like that so
moving on of course
with every sketchy exploit kit
use at your own risk that's why we're
doing it new vm
and without and without further ado
let's get into the demo
all right so hopping into
the first command
you don't really need vagrant destroy
attack f at the beginning really all of
this is
was really necessary is just the vagrant
up and the vagrant reload
the vagrant up is to start the vm and
the
provisioners and get that started the
vagrant reload is just to
you know reboot the vm and get
the virtual machine working
vagrant destroy f is only needed if you
need to blow it up and start again as i
had to do
many many times
so right now
we've got
the
vagrant up just loading up the gui
and all of this of course is
because it's a vagrant box it's listed
in the
vagrant file and all the provisioners
are included within that github repo as
well
the first part
is what the headli the
gui which is just the virtual box
provider popping up
the when you do it at home yourself just
don't try to
mess with it
or do anything the first thing that'll
start is the tty i wanted to make this
demo as simple as possible so i avoided
um purposely
made it simple enough to have the gui
start up
before
you do anything because there's no sense
in giving you a vm to just have to
wrestle and fight with
i wasn't too i wasn't ultimately
successful we'll see an error message
um that i'm still working out at the end
the next part of that is is just
recording the
well downloading the minecraft x
assets and the exploit kit as i was
talking about before uh the
particular script that i was using was
from was the fey on
cs jndi exploit
[Music]
and of course a lot of there's an
elegant solution involving you know
cloning everything and all that
but since the repo
was taken down just curling the
way back archive was the best bet here
it does seem
the vm does appear to just you know
stall and do nothing for a little while
the reason for that is
because i just
am tired of blowing up the terminal with
arbitrary output
um like the app get and installs are
already bad enough
so what i
so what i did is just made this part
quiet and silent
if you have some networking issues of
course this all
crashes and fades away but um for the
most part miss is just
getting all of the assets installing not
only
the exploit kit but java making sure
that all the environment variables are
set
and these things are batched into stages
for each of the
revisioners
onward
and then shortly after all of
the
minecraft assets and the exploit kits
are downloaded
what we'll do is we'll just
wait for the rest of it to install
then
do a full reboot
one of the main provisioners that will
always run is the serve
dot s s h bash script
all it does is set up two screens one
will have the malicious ldap server set
up and the other one is going to have
the minecraft server
set up
so
there is going to be a big error and
spent
days
days on this
um
and for some reason just
graphics and driver's issues just would
not would got in the way
of this build
but the server started up everything
else is fine
the eula acceptance script is pretty
easy to get
around and you can dive all the details
to when you see it in the repo
right now we're just booting up the vm
and then now that we've got a gui just
log in with the vagrant default
credentials
and
getting started
another part of the setup is just
now that
migration happens
have to have a minecraft account it's
explicitly set aside for this
um
yeah just jump cut to avoid throwing the
password out there
let's go
and of course just so many so many
loading screens the
the java version which has not showed is
open jdk 1.8.0
with patch level with the patch level
before one two one
and for
this particular job installation of
minecraft i really want to target
1.12.2 it's very popular obvious
obviously legacy
and one of the reasons is because of the
modding community so
we're just going to set play
and agree now the one error that just
was a complete show stopper
i don't know why
um because i'm thinking it's the distro
or whatever and we can get to the other
is just
an array index out of bounds which i
included in the repo
um
i promise you i got this working
in a previous youtube video
and we'll just
pull up the screenshots for those and
discuss that instead but
yeah after this loads up it's just array
index out of bounds error for some
reason it just
cannot
find it cannot find the primary display
so
graphics issue graphics and display
driver issues is just par for the course
for pretty much any linux distribution
so yeah it's just
graphics drivers issues and i by the
time i got this recording in i did not
have this issue resolved
i am hoping by the time
present this in person that the issue is
resolved
um
yeah par for
linux driver issues
graphics driver issues so
um alternative solutions are probably
run this on jammy64 instead of bionic
which is what i did in youtube
and
if you hold up a second
the
error message should pop up
ever so
slightly it's no point or exception and
for some reason it's
um
can
this particular install and
configuration can't find opengl for some
reason
even though like my display and
everything works fine
i've covered up the
with that quick pop-up for a second was
the null plug-in exception
and the stat full stack trace of course
was available in github the first
screenshot is
the actual payload within in the context
of minecraft
um this is taken obviously from
the youtube video that i did for or the
project
um when i recorded in
december
um
and the
ape and the ip address is just
you know the network configuration for
this particular virtual machine
the base64 encoded payload is just ls is
the ls command
and you see on the right is the stack
trace within the game and
this is
not the stack trace the server logs and
you see like that um class name foo
and that that's the jndi output of
uploading the class name you can look
into the exploit kit and you can use it
for reverse shell other
commands
base64 encoded and otherwise and that's
it
so let's talk about the impact here
i mean after all minecraft is isn't
really a good scenario for
uh simulating the enterprise impact of
log for shell after all it is
uh an application based on a popular
cross platform framework
hosted publicly
with legacy dependencies
a user base of hundreds if not thousands
of users at one time
and
actually is n is resistant to updates it
changes because it has a consistent
revenue stream
so yeah minecraft is not an is of course
never a good example
uh
so what about remediation so how about
fixing
this
it's easy to say just
patch your systems that's the number one
key thing
use uh better you if the logging version
of log4j is configurable
go into the configuration settings and
do the patch
otherwise
most of the apache pro projects have
already updated it's no longer
considered as zero day
however
some arbitrary application that's built
on
the
apache services may not be patched
in which case this is one of those
things like arbitrary remote code
execution being exploited in the wild
this is where you this is where as
security practitioners professionals you
could say
nah just
try
nah just change your technology
and
that is
that is the best answer the best way we
can go forward with that
so
there have been other patches other ways
of trying to remediate using
regex and all that
um
just really so seriously patch to one
dot
later passed one dot
two dot
one eight
for log for j and move on
so
the reason why this talk is called the
last log for j talk you never need
rather than the last log for shell is
because it's really easy
when
a
huge vulnerability comes from a
particular library that the library
itself has no functionality and utility
it's all about the number one global
vulnerability
that's sort of
part of the risk with free and open and
free and open source software
however
this is just yet one of those cases
where
a simple
like one simple little library
forms the backbone of digital
infrastructure globally and worldwide
and you may think like as
if you're doing penetration tests and
offensive security you'll find things
like lack like for example jquery and
others
where
it seems like instantaneous
it blows up and these libraries are
vulnerable it blows up your scan logs
and servers because there's always a
patch coming always a security patch
coming that's not necessarily a
vulnerability that it is actually part
of the feature
and so
part of
is not just part of a remediation
process part of
what makes
good
security
work in the real world
is just having a community
development maintaining community
that is in line and coupled with the
security community so that when
something comes up
the patch security patches are rolled
into
the
rolled into the net
the release
pipeline
log and the blog for j developers
actually did their best
um
before it was before it was just like
disabling
and all of that but
as the entire world had scrutiny on this
one library for a period of a few weeks
removing the function out it eventually
got the pushback to remove the the jndi
arbitrary jndi lookup functionality
altogether which is
probably which is
i know it seems obvious it seems insane
why would you trust
arbitrary lookups
remember no one
ever it was a feature
of the library
pretty much until november
so
part of going forward a part of the
lessons learned is
for every
free and open source for every library
package find a client
part of it is not only just its feature
set but also looking into the community
does it release patches security patches
often is it well maintained and well
funded
is this something that you need that you
want to be able to integrate within your
own technology stack
and of course these links i'm active
pretty much in way too many places um
it's freo scent so
feel free to
harass me on any of these platforms
and my favorite part of the talk the um
actually portion so if you have
questions about setup
what i did
and also
mistakes that i made feel free