Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Script to identify Log4J affected class for CVE-2021-44228 in a collection of jar files
#!/bin/bash
#########################################################################################################
# Script to identify Log4J affected class for CVE-2021-44228 in a collection of jar files
# Based on this script:
# https://github.com/righettod/toolbox-pentest-web/blob/master/scripts/identify-class-location.sh
#########################################################################################################
if [ "$#" -lt 1 ]; then
script_name=$(basename "$0")
echo "Usage:"
echo " $script_name [APP_LIBS_FOLDER]"
echo ""
echo "Call example:"
echo " $script_name /tmp/app-jars"
exit 1
fi
# Set here the folder path in which all the JAR files of the app were copied
TARGET_CLASS_NAME="org/apache/logging/log4j/core/lookup/JndiLookup.class"
APP_LIBS_FOLDER=$1
WORK_FOLDER=/tmp/work
LIBS_COUNT=$(ls $APP_LIBS_FOLDER/*.jar | wc -l)
echo -e "\e[93m[+] Searching class '$TARGET_CLASS_NAME' accross $LIBS_COUNT libraries...\e[0m"
find=0
find_one=0
i=0
cdir=$(pwd)
for lib in $APP_LIBS_FOLDER/*.jar
do
i=$((i+1))
echo -ne "\rInspecting file $i/$LIBS_COUNT..."
find=$(unzip -l $lib | grep -c "$TARGET_CLASS_NAME")
if [ $find -ne 0 ]
then
find_one=1
echo ""
echo -e "\e[92m[!] Class found in the file '$(basename $lib)'.\e[0m"
echo -e "\e[93m[+] Try to find the Maven artefact version...\e[0m"
rm -rf $WORK_FOLDER 2>/dev/null
mkdir $WORK_FOLDER
unzip -q -d $WORK_FOLDER $lib
cd $WORK_FOLDER
for f in $(grep -r "groupId\s*=\s*org.apache.logging.log4j" *)
do
file_loc=$(echo $f | cut -d":" -f1)
artefact_version=$(grep -Po "version\s*=\s*.*" $file_loc | sed 's/version=//g')
echo "File : $(basename $lib)"
echo "Metadata file : $file_loc"
echo "Log4J version : $artefact_version"
done
cd $cdir
rm -rf $WORK_FOLDER 2>/dev/null
fi
done
if [ $find_one -eq 0 ]
then
echo ""
echo -e "\e[91m[!] Class not found!\e[0m"
else
echo -ne "\r\e[93m[+] Inspection finished.\e[0m"
echo ""
fi
@righettod
Copy link
Author

righettod commented Dec 11, 2021

Usage example:
image

@righettod
Copy link
Author

righettod commented Dec 12, 2021

Refactored version of the script was published here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment