• Stars
    star
    435
  • Rank 100,085 (Top 2 %)
  • Language
    Python
  • License
    MIT License
  • Created almost 3 years ago
  • Updated almost 2 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Find vulnerable Log4j2 versions on disk and also inside Java Archive Files (Log4Shell CVE-2021-44228, CVE-2021-45046, CVE-2021-45105)

log4j-finder

A Python3 script to scan the filesystem to find Log4j2 that is vulnerable to Log4Shell (CVE-2021-44228 & CVE-2021-45046 & CVE-2021-45105). It scans recursively both on disk and inside (nested) Java Archive files (JARs).

log4j-finder results

How it works

log4j-finder identifies log4j2 libraries on your filesystem using a list of known bad and known good MD5 hashes of specific files (currently only JndiManager.class) present in log4j2-core-* packages; the main package that is affected by log4shell. It searches for these files inside Java Archive files and on the filesystem. The log4j2 version is then identified based on the MD5 hash of this file.

To optimize scanning speed, it searches the filesystem and processes ONLY the following filenames:

  • All files with Java ARchive file extensions in the filename (also nested in these archives):
    • *.jar, *.war, *.ear
  • Filenames that we have known bad and good hashes for (also inside above archives, and nested):
    • JndiManager.class

If the file matches one of the extensions mentioned above, it will check inside these archives (all in memory, nothing is unpacked) to search for the filenames that the script has known hashes for. It also looks inside nested archives, for example, a JAR file in a WAR file.

The script does NOT scan other archive file extensions such as 7z, RAR, TAR, BZ2, etc. So, for example, if a JAR file is inside a 7z file, the script will not find it. The rationale is that Java can only load Java ARchive formats so we only scan those.

Unknown MD5 hashes are shown as UNKNOWN; this could happen if a non log4j2 Java package uses the same filename that this script searches for. It's most likely not log4j2 if the identified file path does not contain references to org/apache/logging/log4j. However, manual verification is still recommended.

Downloading and running

You can install log4j-finder using one of the following methods:

Using the release binary

You can download the correct binary for your Operating System:

  • Windows latest (signed): log4j-finder-signed.exe
    • Non signed binaries are also available but can trigger your AntiVirus due to it being a PyInstaller executable. You can also generate the executable yourself, see "Generating log4j-finder executables" on how to do this.
  • Linux x86_64 latest: log4j-finder

If you are on Linux you can also download the latest release and run using one of the following ways:

curl -L https://github.com/fox-it/log4j-finder/releases/latest/download/log4j-finder -o log4j-finder
chmod +x log4j-finder
sudo ./log4j-finder
wget https://github.com/fox-it/log4j-finder/releases/latest/download/log4j-finder -O log4j-finder
chmod +x log4j-finder
sudo ./log4j-finder

Using Python 3

For distribution with Python 3.6+ installed, one following methods also work:

curl -L https://github.com/fox-it/log4j-finder/raw/main/log4j-finder.py -o log4j-finder.py
sudo python3 log4j-finder.py
wget https://github.com/fox-it/log4j-finder/raw/main/log4j-finder.py
sudo python3 log4j-finder.py
git clone https://github.com/fox-it/log4j-finder
cd log4j-finder
sudo python3 log4j-finder.py

Generating log4j-finder executables

Auto generated executables

There is a GitHub Action in the repository that automatically generates a Windows and Linux binary of the log4j-finder.py script using PyInstaller on every commit. The build artifacts of these workflow runs are used to attach to the Releases page.

We are aware that some Anti Virus vendors don't like the Windows binaries, in that case we recommend using generating the executable yourself using the following steps (note that we now also provide signed binaries).

Generating the Windows executable

  1. If you don't have Python 3.6 or higher installed, download it first from https://www.python.org/downloads/

  2. Open a command prompt and use pip to install the pyinstaller package:

    pip install pyinstaller
    
    # In the output you will see where pyinstaller is installed, for example:
    # C:\Users\User\AppData\Roaming\Python\Python310\Scripts
    #
    # Verify using --version
    C:\Users\User\AppData\Roaming\Python\Python310\Scripts\pyinstaller.exe --version
    4.7
  3. Optionally install the colorama package to add support for colors:

    pip install colorama
  4. Download the latest version of the log4j-finder.py script and then run PyInstaller:

pyinstaller --onefile --hidden-import colorama log4j-finder.py

The Windows executable is then in the dist directory: dist\log4j-finder.exe

Generating the Linux executable

Example given for Debian 11:

# Install PyInstaller using pip3
sudo apt update
sudo apt install python3-pip git
pip3 install --user pyinstaller

# Git clone and build using PyInstaller
git clone https://github.com/fox-it/log4j-finder
cd log4j-finder
~/.local/bin/pyinstaller --onefile log4j-finder.spec

# Verify that the binary works
./dist/log4j-finder --help

Usage

Example usage to scan a path (defaults to /):

$ python3 log4j-finder.py /path/to/scan

Or directly a JAR file:

$ python3 log4j-finder.py /path/to/jarfile.jar

Or multiple directories and or files:

$ python3 log4j-finder.py /path/to/dir1 /path/to/dir2 /path/to/jarfile.jar

Exclude files or directories:

$ python3 log4j-finder.py / --exclude "/*/.dontgohere" --exclude "/home/user/*.war"

Note that on Windows it only scans the root c:\ drive if you don't give any extra arguments. We recommend specifying the drives you need to scan on the commandline such as (drives that don't exist are skipped):

log4j-finder.exe c:\ d:\ e:\ f:\

Files or directories that cannot be accessed (Permission denied errors) are not printed.

If you want to see more output, you can give the -v flag for verbose, or -vv for debug mode (only recommended for debugging purposes).

Application arguments:

positional arguments:
  PATH                  Directory or file(s) to scan (recursively) (default:
                        ['/'])

optional arguments:
  -h, --help            show this help message and exit
  -v, --verbose         verbose output (-v is info, -vv is debug) (default: 0)
  -n, --no-color        disable color output (default: False)
  -q, --quiet           be more quiet, disables banner and summary (default:
                        False)
  -b, --no-banner       disable banner (default: False)
  -V, --version         show program's version number and exit
  -e PATTERN, --exclude PATTERN
                        exclude files/directories by pattern (can be used
                        multiple times) (default: None)

Files are scanned recursively, both on disk and in (nested) Java Archive Files

More Repositories

1

dissect

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
779
star
2

aclpwn.py

Active Directory ACL exploitation with BloodHound
Python
632
star
3

cve-2019-1040-scanner

Python
276
star
4

dissect.cstruct_legacy

A no-nonsense c-like structure parsing library for Python
Python
240
star
5

quantuminsert

Quantum Insert
HTML
211
star
6

LDAPFragger

C#
181
star
7

mkYARA

Generating YARA rules based on binary code
Python
179
star
8

linux-luks-tpm-boot

A guide for setting up LUKS boot with a key from TPM in Linux
Shell
175
star
9

Invoke-CredentialPhisher

PowerShell
170
star
10

bloodhound-import

Python based BloodHound data importer
Python
141
star
11

dissect.cobaltstrike

Python library for dissecting and parsing Cobalt Strike related data such as Beacon payloads and Malleable C2 Profiles
Python
139
star
12

danderspritz-evtx

Parse evtx files and detect use of the DanderSpritz eventlogedit module
Python
139
star
13

cryptophp

CryptoPHP Indicators of Compromise
Python
128
star
14

cobaltstrike-extraneous-space

Historical list of {Cobalt Strike,NanoHTTPD} servers
125
star
15

cobaltstrike-beacon-data

Open Dataset of Cobalt Strike Beacon metadata (2018-2022)
Jupyter Notebook
114
star
16

OpenSSH-Session-Key-Recovery

Project containing several tools/ scripts to recover the OpenSSH session keys used to encrypt/ decrypt SSH traffic.
Python
72
star
17

acquire

acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.
Python
57
star
18

OpenSSH-Network-Parser

Project to decrypt and parse SSH traffic
Python
54
star
19

bro-scripts

Bro-IDS scripts
Bro
51
star
20

cisco-ios-xe-implant-detection

Cisco IOS XE implant scanning & detection (CVE-2023-20198, CVE-2023-20273)
Python
38
star
21

dissect.cstruct

A Dissect module implementing a parser for C-like structures.
Python
30
star
22

operation-wocao

Operation Wocao - Indicators of Compromise
YARA
30
star
23

dissect.target

The Dissect module tying all other Dissect modules together. It provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets).
Python
27
star
24

dll-hijacking-poc

A quick POC on how to embed a meterpreter in Firefox via DLL hijacking
C
17
star
25

citrix-netscaler-triage

Dissect triage script for Citrix NetScaler devices
Python
17
star
26

Decrypt-TFSSecretVariables

PowerShell
15
star
27

ponmocup

Ponmocup Indicators of Compromise
13
star
28

signed-phishing-email

Python
11
star
29

pcap-broker

PCAP-over-IP server written in Golang
Go
11
star
30

mofang

Mofang Indicators of Compromise
10
star
31

spookyssl-pcaps

SpookySSL PCAPS and Network Coverage
10
star
32

dissect.esedb

A Dissect module implementing a parser for Microsofts Extensible Storage Engine Database (ESEDB), used for example in Active Directory, Exchange and Windows Update.
Python
10
star
33

dissect-docs

Dissect documentation project
7
star
34

log4shell-pcaps

Log4Shell PCAPS and Network Coverage
Java
7
star
35

dissect.evidence

A Dissect module implementing a parsers for various forensic evidence file containers, currently: AD1, ASDF and EWF.
Python
7
star
36

dissect.ntfs

A Dissect module implementing a parser for the NTFS file system, used by the Windows operating system.
Python
7
star
37

dissect.eventlog

A Dissect module implementing parsers for the Windows EVT, EVTX and WEVT log file formats.
Python
6
star
38

saitama-server

Server-side implementation for the Saitama implant, useful for detection engineering purposes
Python
6
star
39

flow.record

Recordization library
Python
6
star
40

django-auth-policy

Django Authentication Policy
Python
6
star
41

psixbot

PsiXBot Indicators of Compromise
5
star
42

reasm

Extract parts of the malware and re-compile it on linux for decrypting stuff using same malware algorithms.
Python
5
star
43

aws-lambda-kinesis-windowseventlog

AWS lambda to transform the json from AWS kinesis agent to useful json documents for elasticsearch
Python
5
star
44

dissect.cim

A Dissect module implementing a parser for the Windows Common Information Model (CIM) database, used in the Windows operating system.
Python
5
star
45

dissect.hypervisor

A Dissect module implementing parsers for various hypervisor disk, backup and configuration files.
Python
4
star
46

Decrypt-OrchestratorSecretVariables

PowerShell
4
star
47

dissect.sql

A Dissect module implementing a parsers for the SQLite database file format, commonly used by applications to store configuration data.
Python
4
star
48

blister-research

Scripts, YARA and IOCs from our research on the Blister malware 🩹
Python
3
star
49

dissect.clfs

A Dissect module implementing a parser for the CLFS (Common Log File System) file system of Windows.
Python
3
star
50

dissect.volume

A Dissect module implementing a parser for different disk volume and partition systems, for example LVM2, GPT and MBR.
Python
3
star
51

dissect.ole

A Dissect module implementing a parser for the Object Linking & Embedding (OLE) format, commonly used by document editors on Windows operating systems.
Python
3
star
52

dissect.vmfs

Dissect module implementing a parser for the VMFS file system, used by VMware virtualization software.
Python
3
star
53

dissect.regf

A Dissect module implementing a parser for Windows registry file format, used to store application and OS configuration on Windows operating systems.
Python
3
star
54

Invoke-BadPwdCountSprayer

2
star
55

dissect.fat

A Dissect module implementing parsers for the FAT and exFAT file systems, commonly used on flash memory based storage devices and UEFI partitions.
Python
2
star
56

dissect.shellitem

A Dissect module implementing a parser for the Shellitem structures, commonly used by Microsoft Windows.
Python
2
star
57

dissect.util

A Dissect module implementing various utility functions for the other Dissect modules.
Python
2
star
58

dissect.ffs

A Dissect module implementing a parser for the FFS file system, commonly used by BSD operating systems.
Python
2
star
59

dissect.xfs

A Dissect module implementing a parser for the XFS file system, commonly used by RedHat Linux distributions.
Python
2
star
60

dissect-workflow-templates

Workflow templates for the dissect projects
2
star
61

dissect_legacy

Namespace and collection package for all dissect projects
Python
2
star
62

dissect.extfs

A Dissect module implementing a parser for the ExtFS file system, the native filesystem for Linux operating systems.
Python
1
star
63

dissect.btrfs

A Dissect module implementing a parser for the btrfs file system.
Python
1
star
64

dissect.etl

A Dissect module implementing a parser for Event Trace Log (ETL) files, used by the Windows operating system to log kernel events.
Python
1
star