# kozmer/log4j-shell-poc architecture

> Architecture diagram of the GitHub repository kozmer/log4j-shell-poc, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/kozmer/log4j-shell-poc
- Repository: https://github.com/kozmer/log4j-shell-poc

## Overview

This repository pairs a Python proof-of-concept launcher with a vulnerable Java web application. The user starts the PoC and a shell listener, then submits the generated JNDI lookup string to the application; the PoC serves the compiled Java payload over HTTP and starts an LDAP reference server. The README documents the intended outcome, while Java application internals were not sampled, so those runtime links are grounded only in the README rather than inferred from source.

Main entry points: [`poc.py`](https://github.com/kozmer/log4j-shell-poc/blob/main/poc.py) (PoC launcher), [`vulnerable-application/src/main/webapp/WEB-INF/web.xml`](https://github.com/kozmer/log4j-shell-poc/blob/main/vulnerable-application/src/main/webapp/WEB-INF/web.xml) (Web application), [`vulnerable-application/src/main/java/com/example/log4shell/LoginServlet.java`](https://github.com/kozmer/log4j-shell-poc/blob/main/vulnerable-application/src/main/java/com/example/log4shell/LoginServlet.java) (Login servlet), [`vulnerable-application/src/main/java/com/example/log4shell/log4j.java`](https://github.com/kozmer/log4j-shell-poc/blob/main/vulnerable-application/src/main/java/com/example/log4shell/log4j.java) (Logging implementation)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_poc["Exploit PoC"]
  node_launcher["PoC launcher<br/>[poc.py]"]
  node_payload["Payload generator<br/>[poc.py]"]
  node_ldap["LDAP reference server<br/>[poc.py]"]
  node_http["Payload HTTP server<br/>[poc.py]"]
  node_java_payload["Reverse-shell payload<br/>[poc.py]"]
end

subgraph group_app["Vulnerable Application"]
  node_webapp["Web application<br/>[web.xml]"]
  node_login["Login servlet<br/>[LoginServlet.java]"]
  node_logging["Logging implementation<br/>[log4j.java]"]
  node_page["Application page<br/>[index.jsp]"]
end

node_user(("Operator"))
node_listener(("Shell listener"))

node_user -->|"starts"| node_launcher
node_launcher -->|"generates"| node_payload
node_launcher -->|"starts"| node_ldap
node_launcher -->|"starts"| node_http
node_http -->|"serves"| node_java_payload
node_user -->|"starts"| node_listener
node_user -->|"submits lookup"| node_webapp
node_webapp -.->|"routes requests"| node_login
node_login -.->|"logs input"| node_logging
node_logging -.->|"triggers lookup"| node_ldap
node_java_payload -->|"opens shell"| node_listener

click node_launcher "https://github.com/kozmer/log4j-shell-poc/blob/main/poc.py"
click node_payload "https://github.com/kozmer/log4j-shell-poc/blob/main/poc.py"
click node_ldap "https://github.com/kozmer/log4j-shell-poc/blob/main/poc.py"
click node_http "https://github.com/kozmer/log4j-shell-poc/blob/main/poc.py"
click node_java_payload "https://github.com/kozmer/log4j-shell-poc/blob/main/poc.py"
click node_webapp "https://github.com/kozmer/log4j-shell-poc/blob/main/vulnerable-application/src/main/webapp/WEB-INF/web.xml"
click node_login "https://github.com/kozmer/log4j-shell-poc/blob/main/vulnerable-application/src/main/java/com/example/log4shell/LoginServlet.java"
click node_logging "https://github.com/kozmer/log4j-shell-poc/blob/main/vulnerable-application/src/main/java/com/example/log4shell/log4j.java"
click node_page "https://github.com/kozmer/log4j-shell-poc/blob/main/vulnerable-application/src/main/webapp/index.jsp"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_launcher,node_payload,node_ldap,node_http,node_java_payload toneBlue
class node_webapp,node_login,node_logging,node_page toneAmber
class node_user,node_listener toneIndigo
```

## Components

### Exploit PoC

- [PoC launcher](https://github.com/kozmer/log4j-shell-poc/blob/main/poc.py): `poc.py`
- [Payload generator](https://github.com/kozmer/log4j-shell-poc/blob/main/poc.py): `poc.py`
- [LDAP reference server](https://github.com/kozmer/log4j-shell-poc/blob/main/poc.py): `poc.py`
- [Payload HTTP server](https://github.com/kozmer/log4j-shell-poc/blob/main/poc.py): `poc.py`
- [Reverse-shell payload](https://github.com/kozmer/log4j-shell-poc/blob/main/poc.py): `poc.py`

### Vulnerable Application

- [Web application](https://github.com/kozmer/log4j-shell-poc/blob/main/vulnerable-application/src/main/webapp/WEB-INF/web.xml): `vulnerable-application/src/main/webapp/WEB-INF/web.xml`
- [Login servlet](https://github.com/kozmer/log4j-shell-poc/blob/main/vulnerable-application/src/main/java/com/example/log4shell/LoginServlet.java): `vulnerable-application/src/main/java/com/example/log4shell/LoginServlet.java`
- [Logging implementation](https://github.com/kozmer/log4j-shell-poc/blob/main/vulnerable-application/src/main/java/com/example/log4shell/log4j.java): `vulnerable-application/src/main/java/com/example/log4shell/log4j.java`
- [Application page](https://github.com/kozmer/log4j-shell-poc/blob/main/vulnerable-application/src/main/webapp/index.jsp): `vulnerable-application/src/main/webapp/index.jsp`

### Other components

- **Operator**
- **Shell listener**

## Connections

- Operator → PoC launcher: starts (evidence: `README.md`)
- PoC launcher → Payload generator: generates (evidence: `poc.py`)
- PoC launcher → LDAP reference server: starts (evidence: `poc.py`)
- PoC launcher → Payload HTTP server: starts (evidence: `poc.py`)
- Payload HTTP server → Reverse-shell payload: serves (evidence: `poc.py`)
- Operator → Shell listener: starts (evidence: `README.md`)
- Operator → Web application: submits lookup (evidence: `README.md`)
- Web application → Login servlet: routes requests
- Login servlet → Logging implementation: logs input
- Logging implementation → LDAP reference server: triggers lookup (evidence: `README.md`)
- Reverse-shell payload → Shell listener: opens shell (evidence: `poc.py`)