Skip to content

Instantly share code, notes, and snippets.

@byt3bl33d3r
byt3bl33d3r / log4j_rce_check.py
Created December 10, 2021 06:02
Python script to detect if an HTTP server is potentially vulnerable to the log4j 0day RCE (https://www.lunasec.io/docs/blog/log4j-zero-day/)
#! /usr/bin/env python3
'''
Needs Requests (pip3 install requests)
Author: Marcello Salvati, Twitter: @byt3bl33d3r
License: DWTFUWANTWTL (Do What Ever the Fuck You Want With This License)
This should allow you to detect if something is potentially exploitable to the log4j 0day dropped on December 9th 2021.

Sony Bravia HTTP API

The sony bravia has a HTTP API interacted with using a Pre-Shared key. There's a more complex auth flow but I've not described it here.

There wasn't any documentation, so I've written some. If you're a TV integrator don't read this, you'll laugh. I'm probably just getting confused by UPnP.

Disclaimer: I've only tested this on my TV, which is a KDL-50W829B. Your TV might not have all of the services; see Available services section for how to discover what your TV supports.