CVE-2021-44228 - Log4j - Minecraft Vulnerable and So Much More

This course examines the Log4Shell vulnerability in Java's Log4j package through demonstrations against vulnerable applications, including unpatched Minecraft servers. It covers remote code execution, reverse shells, detection, bypasses, vulnerability testing, and defensive industry responses.

Syllabus

- Introduction.
- Tweet on gaining RCE via Minecraft.
- Overview of topics covered in video.
- Context surrounding Log4j exploit.
- Blog posts & Github repositories on CVE-2021-44228.
- [Demo] Exploiting Log4j to get a callback to attacker-controlled server.
- [Demo] Exploiting Log4j via unpatched Minecraft server (Spawning calc.exe).
- [Demo] Exploiting Log4j via unpatched Minecraft server (Spawning a reverse shell).
- How the industry is responding from a defense perspective.
- Industry chatter surrounding CVE-2021-44228.
- Blog post discussion.
- Open Source Log4Shell Vulnerability Tester.
- Conclusion.