Hi and welcome back to Section five Blackhead Tricks with Net cat.
In this video we're gonna talk about Nets CAT role in log four J
exploitation. Log four J is a Java based framework,
with's main function of logging client activities.
Log four J framework is used to record user activity and the behavior
of applications for subsequent review. In December, 2021,
experts discovered a critical vulnerability known as log four shell
heads of vulnerability link to the open source login library.
Apache Log four J two,
which has been actively exploited and bad actors have made millions of
exploit attempts of the log four J to Java library.
The vulnerability is a potential thread to millions more
applications and devices across the globe.
A lot of software is depend on Log four J and this vulnerability target
operational failures at multiple fronts.
This vulnerability enables a remote attacker to take control of a
device on the internet. If a device is running certain version of Log four J,
in this scenario,
a remote shell can be obtained on a target system using a log four J open
source exploit that is available to anyone.
Log four J systems allow log messenger to have format strings in
which external information is reference
J N D I.
And this process allows information to be retrieved remotely through various
protocols search as ldap lightweight directory access
protocol.
J N D I lookup is the Java naming and director interface
and work as a Java a p i for a director service that allows
Java software clients to discover and look up data and eat
and resources is vulnerability is a critical zero day
vulnerability that allows an attacker to use Log four J and A
J N D I in application to generate special requests to an attacker
controller server. J N D A makes a L query.
If log four J finds a string like that we have on the screen
in a log messenger for example,
it starts J N D I to ask the L type server at
malicious path for the exploit object.
So the malicious path is A U L I and this
is a object. So this query, this J N D I query,
query will consult LDAP server for this object.
Any specific deployed object in this case when the response from the LDAP
server reference the U L R JM D i,
we automatically request are exploit class file from the web server
and execute.
So this is the common java file when you have the file name class.
So this request will ask for this file and this
file will be downloaded and executed.
An attacker can insert J N D I reference that,
go to a malicious LDAP server making then read to server a
malicious Java class that make any choice action. So any action can be done.
And because this code that is present in the DOT class could be
as executed.
So this is open a high highway path for any kind of attack.
The malicious below which is a Java class can launch a common line
shell on the victim server.
And rhetoric all its input output streams to our remote web socket,
creating a remote reverse shell. We saw before how we can do this mini net cat.
So we have the example here. We have a net cat with some options, for example,
lp, the port and the option E.
It's mean that we as acute a script or a software program.
In this case here we have an option to run and as acute a terminal for windows
or a bash or a console or a bash for Linux for example.
So this open a high attack options and if
for this vulnerability we have four CVAs CVA is common
vulnerabilities and exposures related for this vulnerability
for shell CVAs. That's means this uh,
representation of when we have a vulnerability that was confirmed and
logged and we have the step by step for example or for reproduce,
this exploit and vulnerability or we have some path to resolve
and to conclude to close this vulnerability for example. So it's like a,
a big database of all information for some vulnerability.
In this case, we have four vulnerabilities. We have four CVAs.
The format of CVA is the name cva.
We have the year of this vulnerability in this case 2021
and we have the ID for this vulnerability. So we have four.
The original was 4 4 2 2 8.
And this vulnerability was possible for an attacker to a execute to random code
using a messenger lookup functionality.
The second one with the ID 4 5 0 4 6.
So this is made a possible for attacker to correct malicious input data that
could cause, uh, information leak or remote code execution.
The third one was win ID 4 5 5.
And this mean that left the door open for an an attacker to indicate a deny of
service does attack actually by causing in definitive
recreational lookup on self-referential lookups,
we have the latest one.
The the new one was a 4 4 8 22 ID and an attacker which control
of the target LDAP server could launch a remote code execution
attack. When a configuration used a jdbc a painter,
G N D J N D I LDAP data source u r i.
So that's mean that this initial vulnerability was a path
to open another ones because we have a lot of people and explore this
vulnerability and one point can open a lot of others
points and be explos of points like a,
a cascade of vulnerability possibilities.
So for these vulnerability specifically for log four J,
we have initial point and we have some points of vulnerability
in this case, the total of four vulnerabilities. So this is a,
a very important vulnerability because a lot of systems in the internet
use this log framework.
So in 2021 we have hype for the attack
and all the IT market run a lot try to
resolve and to update all kind of software that use these log
framework because any software that use this log
framework was exposed to receive this kind of attack.
So this was very, very dangerous. And so this is an important point to ours.
Update the software or or driver of frameworks, libraries,
doesn't matter what we use in our system and softwares in this video.
Cat's role in four exploitation and how
important this vulnerability.
The next section we'll take a look at net net.
I hope to see you there.