how to automate the detector of vulnerability Scanner for log for shell Remote code Execution
log for J. CV 2021 44228 I'm going to show you in a live
demo with some simple and code I'm Luca Burton and welcome in today's episode of and pilot
What is log for Shell Remote code Execution log for J CV 2021 44228
Remember 2014. herd was a bag of open SSL, the most popular open source
code library for transport layer security T L s and secure socket layer SSL Protocol Use
the for encrypting website and software. at the time, the flow allowed to read confidential information
allowing the hacker to trick a vulnerable Web server with encryption keys
back to the present log for J. The Java programme, compromised by the Log for Shell bug
is a widely used multi platform open source. Java Login Framework Library developed and maintained
under the volunteer Apache Software Foundation. Log four J is widely used on Web server to record
user activities to analyse data by security or development teams. Hackers could use the log for shell
flow to access sensitive information on widely of device. plant a ransomware attack
and take over machine to mine Cryptocurrency. The vulnerability was discovered almost by happens state when Microsoft
announced it has found suspicious activity in Minecraft Java edition, a popular video game it owns
The flow was officially founded by Chen Z of Alibaba's Cloud Security team on the 24th of
November 2021. Some estimation by weeds and a R E The vulnerability affect
93% of enterprise cloud environment affected commercial service include Amazon Web service
Cloud Flare, iCloud, Minecraft, Java edition Steam, Tencent, QQ and many others
demo. A real life demo. How to automate the reddit detector log for shell remote code execution
log for J CV 2021 44228 on Linux with enable Playbook
Are you ready? Let's have a fun. Wait a minute. Where I could find more information about this bug
You probably remember that her blood has a really nice Web page where all the information was shared
Yes, Unfortunately, it's not available for Shell for log for shell. So you need to start from Wikipedia
But there are better places where to move forward about the security things
Let me share with you. Do you want more information about CV 2021
44228. Go directly to me dot org and you have all the affected version
and the security bulletin from all the major company involved. As you can see
there is a lot of fun here. And moreover, if you want more investigation information
I will suggest to go to the N the National Vulnerability Database directly from the United States government
As you can see, here you have the severity, classification and all the reference advisory solution
and tools. And this is a great source. I really recommend you to take a look
in my demo, I'm going to reference the red that security bulletin 2021 009 Log for Shell
that is pointing to CV 2021 4428, as you can see, was published on December 10th and
was updated on yesterday. So 21st of December. The impact is critical
So take a closer look. And I really appreciate that, uh, red
that is, uh, sharing all the affected product for all the customer and especially on the tech information
There are a lot of information about the mitigation and more technical detail
Also the impact on cloud services and all the affected product that has already a security advisory how
to fix and patch it. But the most important part is this detector script
but as you can see is a simple base script that you can download from the website and allowing
to download is going to download this base script to test if your system is affected and we are going
to automate the execution of this code in our playbook, Let's take a look on the producer
in my editor. So first of all, let's open the best script
As you can see it very long code brought by reddit engineers to verify if a version is affected or not
The most important part is the usage part where you could specify the scan path
So the path where your web application run usually on the wire and t MP path is where the detector is
going to do all his job and also save the report. This detector
uh, need a library. Exactly. And zip programme installed on the machine
You can see this online 300. As you can see, you need to have unzip that
256 some and some other utility installed on the machine. I'm going to manage in my answerable code
So let's take a note of whatever over the code is quite complex
As you can see, basically, it is going to if the version of Lock four J is the 11 of the
one affected. But, uh, it is not able to understand if you already did some mitigation
but this is quite good. At least you have a general advice
Uh, if your system is affected or not, and let me highlight
uh, more, uh, as you can see here, there is a ref. Mm
the finding of a log for J exactly inside your code. And here you can have a more deep
uh, understanding on how what your code is the code is doing for comparison
Uh, each result is going to be saved on the t MP path
and basically, this code is going to return at zero if your system is not affected and a different result If
it is and very interesting is, uh, let me take a look
Uh um, you can see that there is, uh, it is going to save a T X D file inside the R path
Here we go. Exactly. You have this file one log for J path dot T X t inside the T MP
directory. So that is going to save more technical information. If your system is
uh, vulnerable and you can deep dive on this, I think it's a great code
As you can see, it's more than 1600 Linus code, and it's quite useful
so now we are going to use it. another important thing that red that is providing is
the P GP signature of the detector or scanning script. So you are able to verify that the code that you are running it is
100% the same of the one released by the security team. This is very important
especially this type of investigation. So you are 100% sure that the code is the one right
for you and not being altered in any way from our men in the middle or other type of attack
so we need to verify. that the code that we downloaded is the one provided by Reddit before
running the code, and we are going to do all of these things in one answerable playbook code
First of all, let me start my V y m l where I put some variable and trigger that I would like to use in
my answerable playbook. Let me begin with one comment. Let me add the red hat detector information
and, uh, the the T and the URL of the page so everybody can download the this documentation
Let me start with S H. Underscore the T variable that is going to save the file
Name of the red. That detector, in my case, CV, et cetera
uh, s underscore. Signature is going to, uh, have a name. Fine
Name of GP G signature. So same name dot a s G as
uh, uh, extension and detector. Underscore. Base URL is the web others where we download
this file from, So it's going to be the full puff HTTP s
Mm. slash slash access dot reddit dot com then
there will be slash sides slash defaults. slash five Here
we go. This base path will combine with detector and signature to download this file from the Web
uh, after this, uh, I would like to define detector underscore path
That will be the file system. Path to scan. Uh, let me put the default to slash y
because probably Web app will be under WiFi system. Bear in mind that Don't the detector script need
to be in a different path? Exactly. I'm going to download and detector
Underscore, dear. So slash t MP slash CV 2021 4428. uh, the T MP path
need to be with executable permission. So if you run with no exact t MP
you need to use a different path. And, uh, the detector underscore hand
There is the T MP path of the detector script. In my case
will be t MP will be the place where the report will be saved
The t underscore option. We specify some, uh, common line option minus
uh, Dash n Dash D dash no progress dash dash scan. And here we specify the path to
scan, uh, the value of the t underscore Puff, in my case
and, uh, another important thing is GP g Underscore Key Key ID
where we store This is the official red at the product security key
this G PG key ID is released officially by Red, that product security team
So I need only to copy and paste from the website and let me add GP G Public key
This is a full command line that is going to be executed
So GP G key server, for example. Gp g dot m i t dot edu But you can choose your favourite one
and dash dash receive And the key ID that we just define a few line before
Hm? Let me add also, some boolean clean run before which is for clean uh
the run directory before execution and delete after to delete all the detector the
uh after execution I prefer to keep on force. So just in case you would like to review the result verify
GP G is a bull that allow me to enable or disable the GP G signature verification
In my case, I'm keeping to true because I think that you really want this feature
So as you can see, we define some variable that we are going to use in our N C cable playbook to perform
all the tasks to download the uh detector from red that website and the signature
Verify the signature and run from line. So let's jump to the answerable playbook where the fan happens
Are you ready? Let's go. great. Now we have a viable configured
Let's move to a main playbook where the action happens. So first of all
let's begin our playbook with a Y head for Dash and let's give a name detector
for Apache. Log for Jay. and let me specify also the CV V number
So CV 2021-44228. Here we go. We would like to
target hosts all of our inventory, and I need become set to two because
I would like a previledge escalation with H So all the following will be executed by H
Let's begin our tasks list. So 1st, 1st things include underscore v to include
our viable file. In my case, it vas dot y m l all the things that we defined before
Uh, first step will be to install, uh, dependent. Verify the dependency are present on the target machine
I'm going to use enable dot built in dot package so we can cover all the Linux
uh, distribution with this and packages and the per state present. Let me also add
update underscore cash to to refresh the package manager cache So, um
let me next ask name. Create detector directory. This is the directory
where we downloaded the file and we performed also the execution. We need enable built in file
parameters. So first of all, we specify the path in my case will be the value of a viable
detector underscored. not a bath. is de. Here
we go. and this data will be director in. because
we are going to create a directory. Here we go. Is he busy
next task will be to name. uh, download the detector
from the red website. in this task, I'm going to download the bash
detector and also the signature file using enable built in get underscore URL model
some parameter first is URL. Let me compose using the value of detector
Uh, what is a base? URL What was the viable detector? Underscore Base URL
Here we go. And let me add also, the following part with that is the file name
In my case, I'm going to use a loop, so let me use the special variable item for this
uh, destination B will be the detector. So detector underscore, deer. Here we go
uh, this is, uh and of course, the special variable item to use the same exact name
as, uh, the file downloaded, uh, on the mode. I need to guarantee the execution permission of the dash script yet
Technically, the signature don't need, but let's simplify. So 0755 on a hoop and go
uh, route as well. Uh, let me add the loop. So we underscore items and let me specify two elements
The first is, uh, the value of a variable. My case s h like a share
Underscore detector. Here we go. And the second line will be the value of a variable
S h underscore signature. and let me close. OK, so this T is
going to download these two file from me that website. Mm. Now we are ready to perform the GP
G signature verification. So let's start with, uh, GP g Public key
The first thing we need to download the product security key. And I'm going to use nable built in shell model
And in my case, let me use the value of a viable GP
G underscore. What was the command? Uh, public underscore K. Here we go
And unfortunately, there is no GP g direct model. So we need to rely on the shell and let me also add the condition
In my case when verify Underscore GP g is true. Not the not the valuable
Yeah. Here, the Here we go. so this step will be omitted if we don't want the GP
g verification. But I really recommend because it's very easy, uh, and automatically vincible
Now we are ready for the GP G verification pro process. So we technically are going to verify the signature
against the detector by script. So with n b dot built in dot shell Again
Let me specify. The common line in my case will be GP G and van
Uh, some, uh, dash dash verify. OK, First will be the path of
the signature. So under detector there, Here we go. We combine together with
uh, the signature. So s SAS h underscore signature. Here we go
Let me close the variable and now specify the file to verify
So that will be on the detector there. Here we go. Very easy to combine together and let me add
Also in my case is S H underscore detector. That is the by script that we would
like to verify. GP G is going to return zero If the key is
uh OK, so will be fantastic. Let me also perform this when verify Underscore GP g equal
Equal. True again. Let me correct the equator. So this two step will be omitted if
uh, we specify verify GP G force. Let me add, uh, more
Uh, finally, we are ready to execute. Uh, no, but no. First of all
let's verify the directory. Uh, let me, uh, remove any directory run directory
first of all, uh, remove any detector run directory, so n c b dot built in dot file The path will be
under, uh, detector. Underscore de you see that using variable is very comfortable
in answerable. So that will be the detector. T MP directory, in my case
is t MP. You can customise as you wish detector underscore and underscore D Here we go
And, uh, the state will be absent because we would like to verify that
uh, this director is not present on the target system. Let me also
uh, verify my bole. That will be clean. Underscore r underscore before set to true
Uh, OK. Next step will be to create the detector and directory
So with the previous one, we verified that a directory doesn't exist
And if exist, we remove. And now we create an empty one because this detector require empty directory to execute
n dot built in dot file. Let me specify the path that will be exactly the same as the preview task
So detector underscore the and detector underscore. And here we go. In this case
this data will be directory. So N B is going to create a new directory
So combine it together with two step will create an empty directory for sure
uh, finally, we are ready to hand record? Yes. Are you excited
Let's go. So run. The actor slash scanner will be a pretty good name
Uh, to execute. I'm going to use n b dot built in dot shell model again
Let me specify the path. So the detector there and then the name of my Sheri s
detector. we need to add also two other parameters. The first is the detector options
is the variable that we specify before, So all the option is going to be added
uh, here in the command line and there is a special moment to add
Also, dash dash T MP That is the temporary directory where the detector EF effectively run
And, uh, we define it like always be concatenating detector underscore deer and in my case
it's detector underscore and underscore deer. So here we go. Uh, finally
this line is going to execute, uh, all the, uh, detector code and verify if
our system is, uh, vulnerable or not. next, uh, step will be to save the file
uh, created by detector and the Randa directory. So let me use the n b dot built-in dot find model
In my path, paths will be the value of the Randa directory
So as usual detector underscore, dear concatenated with detector underscore. Hand underscore
dear. You see it? It's wonderful. and we can save the result
and vulnerable the variable. um, this is an easy way to print
it out on screen, so let me paint the vulnerable, vulnerable. puffs
uh, but you can also perform any further action in answerable now answerable dot built in dot
debug model. and simply specify V parameter to print it out of the variable on screen
Here we go. And the last step will be to clean up the the TAC directory if we want
So remove the T directory. let me use the s four n b dot Built in dot
file. Uh, path will be the value of a valuable detector underscore
there. state absent. and
we would like to condition this to the one. Uh well, how was the name of a viable delete underscore
after settle two. Here we go. You see in we have our playbook to run the detector we
and creating all the necessary preliminary option. Let me zoom it out so we can have all the view of this stuff
We install the unzip software, we create one tempo directory for all the relevant file
We download the file from the internet. We verify the GP G signature
Uh, we create a running directory. Uh, verify that is empty and finally run the detector code completely automatically
and printed out the result on screen. So great, only 60 line of code
And we are able to use the official that detector script completely automatically in all our fleet
This is Dev SE s Yes. Great. Let me fix it out
Only one little typo that will be under the remove. Any detector and directory
Um, yes. I need to verify The condition will be here equal to two
And now the playbook is completed. Let's jump to the console for see the execution
Welcome to my console. I'm going to show you the execution of my playbook
running the detector against my demo host demo dot Example com That is the final inside the inventory
So sible dash playbook dash my inventory file and my playbook file is the first connection
as you can see, so I need to accept the SS H key. first task is to
uh include the variable. Then we start the exec through real execution
First step is to install. The dependency is going to take a while because we are going to refresh also the repository metadata and
using the package manager of the distribution, We are going to install Van zip the utility
then create the detector directory and download the file directly from the Reddit website files First
is the detector and the second is the public key. To verify it
uh, we are fetching the public registry in my case, the M I t database to
uh, fetch the red product security key. It's going to take some moment just
uh, time to wait and fetch the fetch. Uh, the public key to verify the script
Here we go. Finally, the script is already verified. Uh, we create now the R directory and we are ready to run
The detector scan is going to take a while. It depends how many file the performance of your system
and the underlying file system where the fault is going to scan all the bar partition and
pointed out the result on screen in my case as you see
the files list is empty, so there will be no files under the directory
Let me connect to the target machine because, uh uh, as you can see
I was not removing the detector directory so we can take a look of the year inside
So this machine is not vulnerable to the log for J. me connect via SSH to the target machine
to verify the directory structure. So SSH DeVos is my user name at demo dot example dot com
and it's going to take a while. My network connection is a bit slow today
Let me connect. Uh, again. Let me type again. My Oh, here we go
Now we are inside the virtual machine and let me list the content of my detector directory
That is under T MP. I created the CV path. As you can see
there is the detector by script and the public key under the T MP
the, uh, script creator Report directory where all the text file overrunning vulnerability are
going to create. In my case, there is none. So which means that this machine is not affected by this
uh, flow so great. Let's celebrate and good job, hands, ball. Now
you know how to automate the detector of log for shell remote code execution log for J CV
2021 44228 on Linux with answerable. Thank you for watching. If you enjoyed this
code, write a comment. Give me a thumbs up and keep in contact with me and see us on the next it
adventure of n p dot this video is part of our enable automation programme
Sign up today on W W w enable plot dot com for uninterrupted exclusive video and so much fun