#!/bin/bash #########################################################################################################

Script to identify Log4J affected class for CVE-2021-44228 in a collection of EAR/WAR/JAR files

Based on this script:

https://github.com/righettod/toolbox-pentest-web/blob/master/scripts/identify-class-location.sh

######################################################################################################### if [ "#" -lt 1 ]; then script_name=(basename "$0") echo "Usage:" echo " $script_name [BASE_SEARCH_FOLDER]" echo "" echo "Call example:" echo "$script_name /apps" exit 1 fi

Constants

JAR_FOUND=0 TARGET_CLASS_NAME="org/apache/logging/log4j/core/lookup/JndiLookup.class" APP_LIBS_FOLDER=$1 WORK_FOLDER=/tmp/work JAR_WORK_FOLDER=/tmp/jarwork NESTED_JAR_WORK_FOLDER=/tmp/nestedjarwork CDIR=$(pwd)

See https://unix.stackexchange.com/a/9499

OIFS="$IFS" IFS=$'\n'

Utility functions

inspect_folder (){ folder_location=$1 for jar_lib in $(find "$folder_location" -type f -iname ".jar") do inspect_jar_file "jar_lib" done } inspect_jar_file(){ jar_file_location=\1 find=$(unzip -l "$jar_file_location" | grep -c "$TARGET_CLASS_NAME") if [$find -ne 0 ] then JAR_FOUND=1 echo "" echo -e "\e[91m[!] Class found in the file '$jar_file_location'.\e[0m" echo -e "\e[93m[+] Try to find the Maven artefact version...\e[0m" rm -rf "$JAR_WORK_FOLDER" 2>/dev/null mkdir "$JAR_WORK_FOLDER" unzip -q -d "$JAR_WORK_FOLDER" "$jar_file_location" chmod -R +r "$JAR_WORK_FOLDER" cd $JAR_WORK_FOLDER for f in$(grep -r "groupId\s=\s*org.apache.logging.log4j" ) do file_loc=$(echo$f | cut -d":" -f1) artefact_version=$(grep -Po "version\s*=\s*.*" "$file_loc" | sed 's/version=//g') echo "File : $jar_file_location" echo "Metadata file :$file_loc" echo "Log4J version : $artefact_version" done cd$CDIR rm -rf JAR_WORK_FOLDER 2>/dev/null fi # Handle nested jar case has_nested_jar=(unzip -l "$jar_file_location" | grep "\.jar$" | grep -cv "Archive:") if [ $has_nested_jar -ne 0 ] then nestedjar_lib_name="$(basename "jar_file_location")_RANDOM" mkdir -p "$NESTED_JAR_WORK_FOLDER/$nestedjar_lib_name" unzip -q -d "$NESTED_JAR_WORK_FOLDER/$nestedjar_lib_name" "$jar_file_location" chmod -R +r "$NESTED_JAR_WORK_FOLDER/$nestedjar_lib_name" inspect_folder "$NESTED_JAR_WORK_FOLDER/nestedjar_lib_name" fi } echo -e "\e[93m[+] Searching class 'TARGET_CLASS_NAME' across '$APP_LIBS_FOLDER' folder...\e[0m" for lib in$(find "$APP_LIBS_FOLDER" -type f -iname "*.jar" -o -iname "*.war" -o -iname "*.ear") do filename=$(basename "$lib") filename="$filename" extension="{filename##*.}" printf "\r[*] Inspecting file: %-80s" filename if [ $extension == "ear" ] then rm -rf$WORK_FOLDER 2>/dev/null mkdir $WORK_FOLDER unzip -q -d$WORK_FOLDER "$lib" chmod -R +r$WORK_FOLDER for war_lib in $(find$WORK_FOLDER -type f -iname ".war") do war_lib_name="$(basename "$war_lib")_$RANDOM" war_lib_folder="$WORK_FOLDER/$war_lib_name" mkdir "$war_lib_folder" unzip -q -d "$war_lib_folder" "$war_lib" chmod -R +r "$war_lib_folder" done inspect_folder "$WORK_FOLDER" rm -rf "$WORK_FOLDER" 2>/dev/null fi if [$extension == "war" ] then rm -rf $WORK_FOLDER 2>/dev/null war_lib_name="$(basename "lib")_RANDOM" war_lib_folder=$WORK_FOLDER/$war_lib_name mkdir -p "$war_lib_folder" unzip -q -d "$war_lib_folder" "$lib" chmod -R +r "$war_lib_folder" inspect_folder "$WORK_FOLDER" rm -rf$WORK_FOLDER 2>/dev/null fi if [ $extension == "jar" ] then inspect_jar_file "$lib" fi done printf "\r%-100s" " " if [ $JAR_FOUND -eq 0 ] then echo -e "\r\e[92m[V] Inspection finished - Class not found!\e[0m\n" else echo -ne "\r\e[91m[!] Inspection finished - Class found!\e[0m\n" fi IFS="$OIFS" rm -rf "$NESTED_JAR_WORK_FOLDER" 2>/dev/null exit$JAR_FOUND