Class Log4jRCE

src/main/java-template/Log4jRCE.java:24–221

import java.util.Map;

public class Log4jRCE@suffix@ {
    static final boolean persist = @persistence@;
    static {
        Class<?> c = null;
        try {
            try { // Try for versions of Log4j >= 2.10
                c = Thread.currentThread().getContextClassLoader().loadClass("org.apache.logging.log4j.core.util.Constants");
                Field field = c.getField("FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS");
                System.out.println("Setting " + field.getName() + " value to True");
                setAccess(field);
                field.set(null, Boolean.TRUE);
            } catch (Throwable e) { // Fall back to older versions. Try to make JNDI non instantiable
                c = null;
                System.err.println("No field FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS - version <= 2.9.0");
                System.err.println("Will attempt to modify the configuration directly");
            }

            // Reconfigure log4j
            ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
            Class<?> configuratorClass = classLoader.loadClass("org.apache.logging.log4j.core.config.Configurator");

            // Due to CVE-2021-45046 we're no longer using the reconfigure method -
            // Instead we reconfigure the logger but *also* remove the JNDI listener from the plugin map
            //try {
            //    Method reconfigure = configuratorClass.getMethod("reconfigure");
            //    reconfigure.invoke(null);
            //} catch (Exception ex) {

            Method getFactoryMethod = configuratorClass.getDeclaredMethod("getFactory");
            getFactoryMethod.setAccessible(true);
            Object factory = getFactoryMethod.invoke(null);
            Class<?> log4jContextFactoryClass = classLoader.loadClass("org.apache.logging.log4j.core.impl.Log4jContextFactory");
            Method getSelector = log4jContextFactoryClass.getMethod("getSelector");
            Object contextSelector = getSelector.invoke(factory, (Object[]) null);
            ContextSelector ctxSelector = (ContextSelector) contextSelector;
            for (LoggerContext ctx: ctxSelector.getLoggerContexts()) {
                // The following deadlocks in some tests when using ThreadContext attacks
                //ctx.reconfigure();
                Configuration config = ctx.getConfiguration();
                StrLookup resolver = config.getStrSubstitutor().getVariableResolver();
                if (resolver instanceof Interpolator) {
                    System.err.println("Lookup is an Interpolator - attempting to remove JNDI");
                    Field lookups;
                    //noinspection RedundantSuppression
                    try {
                        //noinspection JavaReflectionMemberAccess
                        lookups = Interpolator.class.getDeclaredField("lookups");
                    } catch (NoSuchFieldException e) {
                        //noinspection JavaReflectionMemberAccess
                        lookups = Interpolator.class.getDeclaredField("strLookupMap");
                    }
                    lookups.setAccessible(true);
                    Map<String, StrLookup> lookupMap = (Map<String, StrLookup>) lookups.get(resolver);
                    lookupMap.remove("jndi");
                }
            }

            //}