Skip to content

Instantly share code, notes, and snippets.

@worksofliam

worksofliam/Log4j_IFS_scan.md

Forked from thebeardedgeek/Log4j_Information_and_Utilities
Last active December 21, 2021 20:52
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save worksofliam/b7377234e75f24ef3503097dabab88a9 to your computer and use it in GitHub Desktop.
Save worksofliam/b7377234e75f24ef3503097dabab88a9 to your computer and use it in GitHub Desktop.
Download ZIP
markdown version
Raw
Log4j_IFS_scan.md

NOTE: I am reading and trying to offer information from what I have seen so far. Everyone will have to conduct their own research and make assessments based on findings.

A way to scan the IFS on an IBM i from QSH

This executes a find utility in QSH

NOTE: this should be on many if not all systems – so far I have tested OS 7.1-7.4 with success (UPDATE: I tested this with v5r4 and it worked as well)

  • SBMJOB - Submits the job, JOB(LOG4JSCAN) names the job, and JOBQ(QCTL) submits it to the controlling subsystem (I have been submitting it here to make sure nothing ends it but you could submit it to another JOBQ)
  • find / - we are searching the root path with find
  • -path /QSYS.LIB -prune -o - I am excluding /QSYS.LIB (since it cannot contain .jar files)
  • -type f - looking for items of the type files
  • -name "*[lL][oO][gG]4[jJ]*" - The name of the file and making sure it’s case insensitive
  • > /log4j_results.txt - And we are piping the results of the find command to
  • -o = means or

NOTE: RUN THIS AS A USER WITH *ALLOBJ AUTHORITY

MAIN COMMAND TO RUN

Omit just QSYS.LIB

SBMJOB CMD(QSH CMD('find / -path /QSYS.LIB -prune -o -type f -name "*[lL][oO][gG]4[jJ]*" > /log4j_results.txt')) JOB(LOG4JSCAN) JOBQ(QCTL)

or Omit QSYS.LIB and QNTC

SBMJOB CMD(QSH CMD('find / -path /QSYS.LIB -prune -o  -path /QNTC -prune -o -type f -name "*[lL][oO][gG]4[jJ]*" > /log4j_results.txt')) JOB(LOG4JSCAN) JOBQ(QCTL)

VARIATIONS TO COMMAND

Variations of the Find command excluding multiple directories

find / -path /QSYS.LIB -prune -o -path /QNTC -prune -o -type f -name "*[lL][oO][gG]4[jJ]*.jar" > /log4j_results.txt

find / -type d \( -name /QSYS.LIB -o -name /QNTC \) -prune -o -type f -name "*[lL][oO][gG]4[jJ]*.jar" > /log4j_results.txt

Variations of case insensitive file name

  • without the 4: -type f -name "*[lL][oO][gG]*[jJ]*"
  • without the 4 and with the .jar extension -type f -name "*[lL][oO][gG]*[jJ]*.jar"
  • with the 4 and the .jar extension -type f -name "*[lL][oO][gG]4[jJ]*.jar"

WATCH THE JOB

  • WRKACTJOB SBS(QCTL) INTERVAL(5)
  • F19 to auto refresh

RESULTS

Reading the results file after the scan it would look something like this:

  • Run: WRKLNK '/log*' and select option 5 to view

NOTE: IF THE RESULTS DON'T SHOW /log4j_results.txt THEN CHECK THAT THE COMMAND WAS SUBMITTED WITHOUT ALTERING THE STRING!!

If you copy and paste make sure it doesn't insert special characters (see below)

QSH CMD('find / -path /QSYS.LIB -prune -o -path /QNTC -prune -o -type f -name "*YlL?YoO?YgG?4YjJ?*" > /log4j_results.txt')

This is not going to return the results you want...

/QSYS.LIB                                                                                                                                            
/QIBM/ProdData/OS/WebServices/V1/server/internal/wsexplorer/org.apache.ant_1.6.5/lib/ant-apache-log4j.jar                           
/QIBM/ProdData/OS/WebServices/V1/server/internal/wsexplorer/org.apache.jakarta_log4j_1.2.8.v200607172048/lib/log4j-1.2.8.jar        
/QIBM/ProdData/OS/WebServices/internal/engines/org.apache.axis2-13/WEB-INF/classes/log4j.properties                                 
/QIBM/ProdData/OS/WebServices/internal/engines/org.apache.axis2-13/WEB-INF/lib/log4j-1.2.14.jar                                     
/QIBM/ProdData/OS/WebServices/internal/engines/org.apache.axis2-15/WEB-INF/classes/log4j.properties                                 
/QIBM/ProdData/OS/WebServices/internal/engines/org.apache.axis2-15/WEB-INF/lib/log4j-1.2.15.jar                                     
/QIBM/ProdData/OS/WebServices/internal/engines/org.apache.axis2-15/WEB-INF/lib/log4j-LICENSE.txt                                    
/QIBM/UserData/OS/ADMININST/admin2/wlp/usr/servers/admin2/workarea/org.eclipse.osgi/219/0/.cp/WEB-INF/lib/log4j-1.2.14.jar          
/QIBM/UserData/OS/ADMININST/admin2/wlp/usr/servers/admin2/workarea/org.eclipse.osgi/219/0/.cp/WEB-INF/lib/slf4j-log4j12-1.5.11.jar  
/QIBM/UserData/OS/ADMININST/admin2/wlp/usr/servers/admin2/workarea/org.eclipse.osgi/219/data/cache/WEB-INF/lib/log4j-1.2.14.jar     
/QIBM/UserData/OS/ADMININST/admin2/wlp/usr/servers/admin2/workarea/org.eclipse.osgi/219/data/cache/WEB-INF/lib/slf4j-log4j12-1.5.11.jar
/QIBM/UserData/OS/OSGi/LWISysInst/admin2/lwi/bin/ant/lib/ant-apache-log4j.jar                                                       
/QIBM/UserData/OS/OSGi/LWISysInst/admin2/lwi/bin/ant/lib/ant-apache-log4j.jar:Zone.Identifier:$DATA                                 
/log4j_results.txt    // <--- You should see this in the results or it didn't run correctly

Helpful Links and Info

These are the possible mitigations for this flaw for releases version 1.x:

  • Comment out or remove JMSAppender in the Log4j configuration if it is used
  • Remove the JMSAppender class from the classpath. For example: zip -q -d log4j-*.jar org/apache/log4j/net/JMSAppender.class
  • Restrict access for the OS user on the platform running the application to prevent modifying the Log4j configuration by the attacker.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment