#CVE-2021
#log4j2

Basic Vulnerable Spring Boot Application to Test CVE-2021-44228

https://github.com/recanavar/vuln_spring_log4j2

@BlueRedTeam

#CVE-2021
#log4j2
Scanner local em Python para localizar e identificar versões vulneráveis do Log4j2 em arquivos no disco com análise interna de arquivos JAR (CVE-2021-44228 e CVE-2021-45046)

https://github.com/andalik/log4j-scanner

@BlueRedTeam

#CVE-2021
Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user

https://github.com/WazeHell/sam-the-admin

@BlueRedTeam

#CVE-2021
#log4Shell

Log4Shell CVE-2021-44228 Vulnerability Scanner and POC

https://github.com/gyaansastra/CVE-2021-44228

@BlueRedTeam

#CVE-2021
#log4j2
Scanner local em Python para varredura e localização de versões vulneráveis do Log4j2 em arquivos no disco, contemplando análise interna de arquivos JAR (CVE-2021-44228 e CVE-2021-45046)

https://github.com/andalik/log4j-filescan

@BlueRedTeam

#CVE-2021
#Log4j
Burp Active Scan extension to identify Log4j vulnerabilities CVE-2021-44228 and CVE-2021-45046

https://github.com/DXC-StrikeForce/Burp-Log4j-HammerTime

@BlueRedTeam

Apache’s Fix for Log4Shell Can Lead to DoS Attacks

Not only is the jaw-dropping flaw in the Apache Log4j logging library ubiquitous; Apache’s blanket of a quickly baked patch for Log4Shell also has holes.

https://threatpost.com/apache-patch-log4shell-log4j-dos-attacks/177064/

#Log4Shell
@PentesterReference

#CVE-2021
#Log4j
Scans for Log4j versions effected by CVE-2021-44228

https://github.com/mergebase/log4j-detector

@BlueRedTeam

#CVE-2021
#Log4j
Applications that are vulnerable to the log4j CVE-2021-44228/45046 issue may be detectable by scanning jar, war, ear, zip files to search for the presence of JndiLookup.class.

https://github.com/hozyx/log4shell

@BlueRedTeam

#CVE-2021
#Log4j
Samples of log4j library versions to help log4j scanners / detectors improve their accuracy for detecting CVE-2021-45046 and CVE-2021-44228.

https://github.com/mergebase/log4j-samples

@BlueRedTeam

#CVE-2021
#Log4Shell

Log4Shell Proof of Concept (CVE-2021-44228)

https://github.com/Kr0ff/CVE-2021-44228

@BlueRedTeam

#CVE-2021
#Log4j
#Log4Shell
Log4j - Multitool. Find & fix possible CVE-2021-44228 vulneraries - provides a complete LOG4SHELL test/attack environment

https://github.com/suuhm/log4shell4shell

@BlueRedTeam

#Exploit
1. CVE-2021-45046:
Log4j 2.15.0 stills allows for exfiltration of sensitive data
https://www.praetorian.com/blog/log4j-2-15-0-stills-allows-for-exfiltration-of-sensitive-data

2. CVE-2021-41962:
Stored XSS in Vehicle Service Management System 1.0
in Sourcecodester
https://github.com/lohyt/-CVE-2021-41962

@BlueRedTeam

#Red_Team

1. Escalate from a low-integrity Administrator account to NT AUTHORITY\SYSTEM without an LPE exploit by combining a COM UAC bypass and Token Impersonation
https://github.com/FULLSHADE/Auto-Elevate
2. AutoSUID is the project, the main idea of which is to automate harvesting the SUID executable files and to find
a way for further escalating the privileges
https://github.com/IvanGlinkin/AutoSUID

@BlueRedTeam

#Blue_Team
1. LOLBins Are No Laughing Matter:
How Attackers Operate Quietly
https://www.uptycs.com/blog/lolbins-are-no-laughing-matter
2. Protection against CVE-2021-45046, the additional Log4j RCE vulnerability
https://blog.cloudflare.com/protection-against-cve-2021-45046-the-additional-log4j-rce-vulnerability

@BlueRedTeam

#CVE-2021
#Log4Shell
Test exploit of CVE-2021-44228

https://github.com/wajda/log4shell-test-exploit

@BlueRedTeam

#CVE-2021
CVE-2021-43798 Grafana 任意文件读取漏洞 POC+参数

https://github.com/ScorpionsMAX/CVE-2021-43798-Grafana-POC

@BlueRedTeam

#CVE-2021
#Log4Shell
A lab demonstration of the log4shell vulnerability: CVE-2021-44228

https://github.com/obscuritylabs/log4shell-poc-lab

@BlueRedTeam

#CVE-2021
#Log4j
PoC RCE Log4j CVE-2021-4428 para pruebas

https://github.com/Grupo-Kapa-7/CVE-2021-44228-Log4j-PoC-RCE

@BlueRedTeam

#CVE-2021
#Log4Shell
An automated, reliable scanner for the Log4Shell (CVE-2021-44228) vulnerability.

https://github.com/redhuntlabs/Log4JHunt

@BlueRedTeam

#CVE-2021
#Log4j
CVE-2021-44228 vulnerability in Apache Log4j library

https://github.com/Heliferepo/log4j

@BlueRedTeam