How kozmer/log4j-shell-poc works
This repository pairs a Python proof-of-concept launcher with a vulnerable Java web application. The user starts the PoC and a shell listener, then submits the generated JNDI lookup string to the application; the PoC serves the compiled Java payload over HTTP and starts an LDAP reference server. The README documents the intended outcome, while Java application internals were not sampled, so those runtime links are grounded only in the README rather than inferred from source.
Main entry points: poc.py PoC launcher · web.xml Web application · LoginServlet.java Login servlet · log4j.java Logging implementation
Components 11
Exploit PoC
- PoC launcher
poc.py - Payload generator
poc.py - LDAP reference server
poc.py - Payload HTTP server
poc.py - Reverse-shell payload
poc.py
Vulnerable Application
- Web application
vulnerable-application/src/main/webapp/WEB-INF/web.xml - Login servlet
vulnerable-application/src/main/java/com/example/log4shell/LoginServlet.java - Logging implementation
vulnerable-application/src/main/java/com/example/log4shell/log4j.java - Application page
vulnerable-application/src/main/webapp/index.jsp
Other components
- Operator
- Shell listener
Connections 11
- Operator → PoC launcher: starts
README.md - PoC launcher → Payload generator: generates
poc.py - PoC launcher → LDAP reference server: starts
poc.py - PoC launcher → Payload HTTP server: starts
poc.py - Payload HTTP server → Reverse-shell payload: serves
poc.py - Operator → Shell listener: starts
README.md - Operator → Web application: submits lookup
README.md - Web application → Login servlet: routes requests
- Login servlet → Logging implementation: logs input
- Logging implementation → LDAP reference server: triggers lookup
README.md - Reverse-shell payload → Shell listener: opens shell
poc.py