Scan all java processes on your host to check weather it’s affected by log4j2 remote code execution
Log4j 漏洞本地检测脚本,扫描主机上所有java进程,检测是否引入了有漏洞的log4j-core jar包,是否可能遭到远程代码执行攻击(CVE-2021-45046)。上传扫描报告到指定的服务器。 Scan all java processes on your host to check weather it’s affected by log4j2 remote code execution(CVE-2021-45046), then upload the report to your api server. Works under python2.7 / 2.6 / 3.x, no extra lib required. 扫描逻辑 遍历主机上的java进程 遍历java进程打开的jar包 查找log4j-core-* jar包 递归解压其他 jar包,查找log4j-core-* jar包 在log4j-core jar包中,查找JndiLookup.class 找到JndiLookup.class后,根据其版本号 、jvm参数、OS环境变量、是否docker容器进程、k8s进程,输出是否存在漏洞,输出升级提示 上传扫描结果到指定的服务器 How It Works Find all java process on the host Find all jar files open by the java process Search for log4j-core-*.jar Recursively unzip other jar files,search for […]
Read more