对Log4Shell CVE-2021-44228 应急响应

Khan安全团队

发布于 2021-12-21 19:30:04

3450

发布于 2021-12-21 19:30:04

文章被收录于专栏：Khan安全团队

PCRE RegEx 在您的日志中匹配 Log4Shell CVE-2021-44228 IOC

正则表达式：

(? im ) (?: ^ | [ \n ] )。* ? (?: [ \x 24 ] | % (?: 25%? ) * 24 | \\ u?0 * (?: 44 | 24 ) ) (?: [ \x 7b ] | % (?: 25%? ) * 7b | \\ u?0 * (?: 7b | 173 ) ) [^ \n ] * ? ( (?: j | % (?: 25%? ) * (?: 4a | 6a ) | \\ u?0 * (?: 112 | 6a | 4a | 152 ) ) [ ^ \n ] * ? (? : n | % (?: 25%? ) * (?: 4e | 6e ) | \\ u?0 * (?: 4e| 156 | 116 | 6e ) ) [ ^ \n ] * ? (?: d | % (?: 25%? ) * (?: 44 | 64 ) | \\ u?0 * (?: 44 | 144 | 104 | 64 ) ) [ ^ \n ] * ? (?: [ i \x {130} \x {131} ] | % (?:25%？) * (?: 49 | 69 | C4% (?: 25%? ) * B0 | C4% (?: 25%? ) * B1 ) | \\ u?0 * (?: 111 | 69 | 49 | 151 | 130 | 460 | 131 | 461 ) ) [ ^ \n ] * ? (?: [ \x 3a ] | %(?: 25%? ) * 3a | \\ u?0 * (?: 72 | 3a ) ) [ ^ \n ] * ? ( (?: l | % (?: 25%? ) * (?: 4c | 6c ) | \\ u?0 * (?: 154 | 114 | 6c | 4c ) ) [ ^ \n ] * ? (? : d |% (?: 25%? ) * (?: 44 | 64 ) | \\ u?0 * (?: 44 | 144 | 104 | 64 ) ) [ ^ \n ] * ? (?: a | % (?: 25%? ) * (?: 41 | 61 ) | \\ u?0 * (?: 101 | 61 | 41 | 141 ) ) [^ \n ] * ? (?: p | % (?: 25%? ) * (?: 50 | 70 ) | \\ u?0 * (?: 70 | 50 | 160 | 120 ) ) (?: [ ^ \n ] * ? (?: [ s \x {17f} ] | % (?: 25%? ) * (?: 53 | 73 | C5% (?:25%？) * BF ) | \\ u?0 * (?: 17f | 123 | 577 | 73 | 53 | 163 ) ) ) ? | (?: r | % (?: 25%? ) * (?: 52 | 72 ) | \\ u?0 * (?: 122 | 72 | 52 | 162 ) ) [ ^ \n ] *? (?: m | % (?: 25%? ) * (?: 4d | 6d ) | \\ u?0 * (?: 4d | 155 | 115 | 6d ) ) [ ^ \n ] * ? (?: [ i \x {130} \x {131} ] | % (?: 25%? ) * (?: 49 | 69 | C4% (?: 25%? )* B0 | C4% (?: 25%? ) * B1 ) | \\ u?0 * (?: 111 | 69 | 49 | 151 | 130 | 460 | 131 | 461 ) ) | (?: d | % (?: 25%? ) * (?: 44 | 64 ) | \\ u?0 * (?: 44 | 144 | 104 |64 ) ) [ ^ \n ] *？(?: n | % (?: 25%? ) * (?: 4e | 6e ) | \\ u?0 * (?: 4e | 156 | 116 | 6e ) ) [ ^ \n ] * ? (?: [ s \x {17f} ] | % (?: 25%? ) * (?: 53 | 73| C5% (?: 25%? ) * BF ) | \\ u?0 * (?: 17f | 123 | 577 | 73 | 53 | 163 ) ) | (?: n | % (?: 25%? ) * (?: 4e | 6e ) | \\ u?0 * (?: 4e | 156 | 116 | 6e ) ) [ ^ \n ]* ? (?: [ i \x {130} \x {131} ] | % (?: 25%? ) * (?: 49 | 69 | C4% (?: 25%? ) * B0 | C4% (?: 25%? ) * B1 ) | \\ u?0 * (?: 111 | 69 | 49 | 151 | 130 | 460 | 131 | 461 ) )[ ^ \n ] * ? (?: [ s \x {17f} ] | % (?: 25%? ) * (?: 53 | 73 | C5% (?: 25%? ) * BF ) | \\ u?0 * (?: 17f | 123 | 577 | 73 | 53 | 163 ) ) | (?: [ ^ \n ] * ? (?: [i \x {130} \x {131} ] | % (?: 25%? ) * (?: 49 | 69 | C4% (?: 25%? ) * B0 | C4% (?: 25%? ) * B1 ) | \\ u?0 * (?: 111 | 69 | 49 | 151 | 130 | 460 | 131 | 461 ) ) ) { 2 }[ ^ \n ] * ? (?: o | % (?: 25%? ) * (?: 4f | 6f ) | \\ u?0 * (?: 6f | 4f | 157 | 117 ) ) [ ^ \n ] * ? (?: p | % (?: 25%? ) * (?: 50 | 70 ) | \\ u?0 * (?: 70| 50 | 160 | 120 ））| (?: c | % (?: 25%? ) * (?: 43 | 63 ) | \\ u?0 * (?: 143 | 103 | 63 | 43 ) ) [ ^ \n ] * ? (?: o | % (?: 25%? ) * (?: 4f | 6f ) | \\ u?0* (?: 6f | 4f | 157 | 117 ) ) [ ^ \n ] * ? (?: r | % (?: 25%? ) * (?: 52 | 72 ) | \\ u?0 * (?: 122 | 72 | 52 | 162 ) ) [ ^ \n ] * ? (?: b | % (?: 25%? ) *(?: 42 | 62 ) | \\ u?0 * (?: 102 | 62 | 42 | 142 ) ) [ ^ \n ] * ? (?: a | % (?: 25%? ) * (?: 41 | 61 ) | \\ u?0 * (?: 101 | 61 | 41 | 141 ) ) | (?: n | % (?:25%？) * (?: 4e | 6e ) | \\ u?0 * (?: 4e | 156 | 116 | 6e ) ) [ ^ \n ] * ? (?: d | % (?: 25%? ) * (?: 44 | 64 ) | \\ u?0 * (?: 44 | 144 | 104 | 64 ) ) [ ^ \n] * ? (?: [ s \x {17f} ] | % (?: 25%? ) * (?: 53 | 73 | C5% (?: 25%? ) * BF ) | \\ u?0 * (?: 17f | 123 | 577 | 73 | 53 | 163 ) ) | (?: h | % (?: 25%? ) * (?: 48 |68 ) | \\ u?0 * (?: 110 | 68 | 48 | 150 ) ) (?: [ ^ \n ] * ? (?: t | % (?: 25%? ) * (?: 54 | 74 ) | \\ u?0 * (?: 124 | 74 | 54 | 164 ) ) ) { 2 } [ ^ \n ]* ? (?: p | % (?: 25%? ) * (?: 50 | 70 ) | \\ u?0 * (?: 70 | 50 | 160 | 120 ) ) (?: [ ^ \n ] * ? (?: [ s \x {17f} ] | % (?: 25%? ) * (?: 53 | 73 | C5% (?: 25%? ) *BF ) | \\ u?0 * (?: 17f | 123 | 577 | 73 | 53 | 163 ) ) ) ? ) [ ^ \n ] * ? (?: [ \x 3a ] | % (?: 25%? ) * 3a | \\ u?0 * (?: 72 | 3a ) ) | (?: b | % (?: 25%?) * (?: 42 | 62 ) | \\ u?0 * (?: 102 | 62 | 42 | 142 ) ) [ ^ \n ] * ? (?: a | % (?: 25%? ) * (?: 41 | 61 ) | \\ u?0 * (?: 101 | 61 | 41 | 141 ) ) [ ^ \n ]* ? (?: [ s \x {17f} ] | % (?: 25%? ) * (?: 53 | 73 | C5% (?: 25%? ) * BF ) | \\ u?0 * (?: 17f | 123 | 577 | 73 | 53 | 163 ) ) [ ^ \n ] * ? (?: e | % (?: 25%? ) *(?: 45 | 65 ) | \\ u?0 * (?: 45 | 145 | 105 | 65 ) ) [ ^ \n ] * ? (?: [ \x 3a ] | % (?: 25%? ) * 3a | \\ u?0 * (?: 72 | 3a ) ) ( JH [ sv ] | [ \x 2b \x 2f-9A-扎-z] [ CSiy ] R7 | [ \x 2b \x 2f-9A-Za-z ] { 2 } [ 048AEIMQUYcgkosw ] ke [ \x 2b \x 2f-9w-z ] ) )

这个正则表达式匹配漏洞利用：

不区分大小写（也在所有支持的编码中）
Url编码
递归 URL 编码
使用 Unicode 编码
八进制编码
Base64 编码

Linux 机器上使用

在 CLI 上 `grep`

eval  " $( ./RegEx_Generator.sh ) " 
grep -P ${Log4ShellRex}  <logfile>

grep -P '(?im)(?:^|[\n]).*?(?:[\x24]|%(?:25%?)*24|\\u?0*(?:44 |24))(?:[\x7b]|%(?:25%?)*7b|\\u?0*(?:7b|173))[^\n]*?((?:j| %(?:25%?)*(?:4a|6a)|\\u?0*(?:112|6a|4a|152))[^\n]*?(?:n|%(? :25%?)*(?:4e|6e)|\\u?0*(?:4e|156|116|6e))[^\n]*?(?:d|%(?:25%) ?)*(?:44|64)|\\u?0*(?:44|144|104|64))[^\n]*?(?:[i\x{130}\x{131 }]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\u?0* (?:111|69|49|151|130|460|131|461))[^\n]*?(?:[\x3a]|%(?:25%?)*3a|\\u? 0*(?:72|3a))[^\n]*?((?:l|%(?:25%?)*(?:4c|6c)|\\u?0*(?:154 |114|6c|4c))[^\n]*?(?:d|%(?:25%?)*(?:44|64)|\\u?0*(?:44|144| 104|64))[^\n]*?(?:a|%(?:25%?)*(?:41|61)|\\u?0*(?:101|61|41|141 ))[^\n]*?(?:p|%(?:25%?)*(?:50|70)|\\u?0*(?:70|50|160|120))( ?:[^\n]*?(?:[s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)| \\u?0*(?:17f|123|577|73|53|163)))?|(?:r|%(?:25%?)*(?:52|72)|\\u ?0*(?:122|72|52|162))[^\n]*?(?:m|%(?:25%?)*(?:4d|6d)|\\u?0* （？：4d|155|115|6d))[^\n]*?(?:[i\x{130}\x{131}]|%(?:25%?)*(?:49|69|C4 %(?:25%?)*B0|C4%(?:25%?)*B1)|\\u?0*(?:111|69|49|151|130|460|131|461)) |(?:d|%(?:25%?)*(?:44|64)|\\u?0*(?:44|144|104|64))[^\n]*?(? :n|%(?:25%?)*(?:4e|6e)|\\u?0*(?:4e|156|116|6e))[^\n]*?(?:[s \x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123|577 |73|53|163))|(?:n|%(?:25%?)*(?:4e|6e)|\\u?0*(?:4e|156|116|6e))[ ^\n]*?(?:[i\x{130}\x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0 |C4%(?:25%?)*B1)|\\u?0*(?:111|69|49|151|130|460|131|461))[^\n]*?(?: [s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123 |577|73|53|163))|(?:[^\n]*?(?:[i\x{130}\x{131}]|%(?:25%?)*(?: 49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\u?0*(?:111|69|49|151|130|460| 131|461))){2}[^\n]*?(?:o|%(?:25%?)*(?:4f|6f)|\\u?0*(?:6f|4f |157|117))[^\n]*?(?:p|%(?:25%?)*(?:50|70)|\\u?0*(?:70|50|160| 120))|(?:c|%(?:25%?)*(?:43|63)|\\u?0*(?:143|103|63|43))[^\n]*?(?:o|%(?:25%?)*(?:4f|6f)|\\u?0*(?:6f|4f |157|117))[^\n]*?(?:r|%(?:25%?)*(?:52|72)|\\u?0*(?:122|72|52| 162))[^\n]*?(?:b|%(?:25%?)*(?:42|62)|\\u?0*(?:102|62|42|142)) [^\n]*?(?:a|%(?:25%?)*(?:41|61)|\\u?0*(?:101|61|41|141))|(? :n|%(?:25%?)*(?:4e|6e)|\\u?0*(?:4e|156|116|6e))[^\n]*?(?:d| %(?:25%?)*(?:44|64)|\\u?0*(?:44|144|104|64))[^\n]*?(?:[s\x{ 17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123|577|73| 53|163))|(?:h|%(?:25%?)*(?:48|68)|\\u?0*(?:110|68|48|150))(?:[ ^\n]*?(?:t|%(?:25%?)*(?:54|74)|\\u?0*(?:124|74|54|164))){2} [^\n]*?(?:p|%(?:25%?)*(?:50|70)|\\u?0*(?:70|50|160|120))(?: [^\n]*?(?:[s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\ u?0*(?:17f|123|577|73|53|163)))?)[^\n]*?(?:[\x3a]|%(?:25%?)*3a|\ \u?0*(?:72|3a))|(?:b|%(?:25%?)*(?:42|62)|\\u?0*(?:102|62|42 |142))[^\n]*?(?:a|%(?:25%?)*(?:41|61)|\\u?0*(?:101|61|41|141) )[^\n]*?(?:[s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123 |577|73|53|163))[^\n]*?(?:e|%(?:25%?)*(?:45|65)|\\u?0*(?:45| 145|105|65))[^\n]*?(?:[\x3a]|%(?:25%?)*3a|\\u?0*(?:72|3a))(JH[ sv]|[\x2b\x2f-9A-Za-z][CSiy]R7|[\x2b\x2f-9A-Za-z]{2}[048AEIMQUYcgkosw]ke[\x2b\x2f-9w-z]) )' <logfile>

使用 Splunk 搜索您的日志

您可以使用此 RegEx 使用| regex SPL命令搜索索引日志

index=<...> sourcetype=<...>
| regex "<Log4ShellRex>"

index=<...> sourcetype=<...>
| regex "(?im)(?:^|[\\n]).*?(?:[\\x24]|%(?:25%?)*24|\\\\u?0*(?:44|24))(?:[\\x7b]|%(?:25%?)*7b|\\\\u?0*(?:7b|173))[^\\n]*?((?:j|%(?:25%?)*(?:4a|6a)|\\\\u?0*(?:112|6a|4a|152))[^\\n]*?(?:n|%(?:25%?)*(?:4e|6e)|\\\\u?0*(?:4e|156|116|6e))[^\\n]*?(?:d|%(?:25%?)*(?:44|64)|\\\\u?0*(?:44|144|104|64))[^\\n]*?(?:[i\\x{130}\\x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\\\u?0*(?:111|69|49|151|130|460|131|461))[^\\n]*?(?:[\\x3a]|%(?:25%?)*3a|\\\\u?0*(?:72|3a))[^\\n]*?((?:l|%(?:25%?)*(?:4c|6c)|\\\\u?0*(?:154|114|6c|4c))[^\\n]*?(?:d|%(?:25%?)*(?:44|64)|\\\\u?0*(?:44|144|104|64))[^\\n]*?(?:a|%(?:25%?)*(?:41|61)|\\\\u?0*(?:101|61|41|141))[^\\n]*?(?:p|%(?:25%?)*(?:50|70)|\\\\u?0*(?:70|50|160|120))(?:[^\\n]*?(?:[s\\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\\\u?0*(?:17f|123|577|73|53|163)))?|(?:r|%(?:25%?)*(?:52|72)|\\\\u?0*(?:122|72|52|162))[^\\n]*?(?:m|%(?:25%?)*(?:4d|6d)|\\\\u?0*(?:4d|155|115|6d))[^\\n]*?(?:[i\\x{130}\\x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\\\u?0*(?:111|69|49|151|130|460|131|461))|(?:d|%(?:25%?)*(?:44|64)|\\\\u?0*(?:44|144|104|64))[^\\n]*?(?:n|%(?:25%?)*(?:4e|6e)|\\\\u?0*(?:4e|156|116|6e))[^\\n]*?(?:[s\\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\\\u?0*(?:17f|123|577|73|53|163))|(?:n|%(?:25%?)*(?:4e|6e)|\\\\u?0*(?:4e|156|116|6e))[^\\n]*?(?:[i\\x{130}\\x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\\\u?0*(?:111|69|49|151|130|460|131|461))[^\\n]*?(?:[s\\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\\\u?0*(?:17f|123|577|73|53|163))|(?:[^\\n]*?(?:[i\\x{130}\\x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\\\u?0*(?:111|69|49|151|130|460|131|461))){2}[^\\n]*?(?:o|%(?:25%?)*(?:4f|6f)|\\\\u?0*(?:6f|4f|157|117))[^\\n]*?(?:p|%(?:25%?)*(?:50|70)|\\\\u?0*(?:70|50|160|120))|(?:c|%(?:25%?)*(?:43|63)|\\\\u?0*(?:143|103|63|43))[^\\n]*?(?:o|%(?:25%?)*(?:4f|6f)|\\\\u?0*(?:6f|4f|157|117))[^\\n]*?(?:r|%(?:25%?)*(?:52|72)|\\\\u?0*(?:122|72|52|162))[^\\n]*?(?:b|%(?:25%?)*(?:42|62)|\\\\u?0*(?:102|62|42|142))[^\\n]*?(?:a|%(?:25%?)*(?:41|61)|\\\\u?0*(?:101|61|41|141))|(?:n|%(?:25%?)*(?:4e|6e)|\\\\u?0*(?:4e|156|116|6e))[^\\n]*?(?:d|%(?:25%?)*(?:44|64)|\\\\u?0*(?:44|144|104|64))[^\\n]*?(?:[s\\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\\\u?0*(?:17f|123|577|73|53|163))|(?:h|%(?:25%?)*(?:48|68)|\\\\u?0*(?:110|68|48|150))(?:[^\\n]*?(?:t|%(?:25%?)*(?:54|74)|\\\\u?0*(?:124|74|54|164))){2}[^\\n]*?(?:p|%(?:25%?)*(?:50|70)|\\\\u?0*(?:70|50|160|120))(?:[^\\n]*?(?:[s\\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\\\u?0*(?:17f|123|577|73|53|163)))?)[^\\n]*?(?:[\\x3a]|%(?:25%?)*3a|\\\\u?0*(?:72|3a))|(?:b|%(?:25%?)*(?:42|62)|\\\\u?0*(?:102|62|42|142))[^\\n]*?(?:a|%(?:25%?)*(?:41|61)|\\\\u?0*(?:101|61|41|141))[^\\n]*?(?:[s\\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\\\u?0*(?:17f|123|577|73|53|163))[^\\n]*?(?:e|%(?:25%?)*(?:45|65)|\\\\u?0*(?:45|145|105|65))[^\\n]*?(?:[\\x3a]|%(?:25%?)*3a|\\\\u?0*(?:72|3a))(JH[s-v]|[\\x2b\\x2f-9A-Za-z][CSiy]R7|[\\x2b\\x2f-9A-Za-z]{2}[048AEIMQUYcgkosw]ke[\\x2b\\x2f-9w-z]))"