A top-down approach to constructing Apache Log4j2 remote code execution statements

Abstract

This invention provides a top-down method for constructing Apache Log4j2 remote code execution statements. In network security attack and defense research, it is necessary to generate a large number of Apache Log4j2 remote code execution statements with obfuscated data. This invention, based on top-down and step-by-step obfuscation methods, can generate a large number of obfuscated statements for a single Apache Log4j2 remote code execution statement.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically the field of remote command execution injection, and specifically relates to a top-down method for constructing Apache Log4j2 remote code execution statements. Background Technology

[0002] On December 9, 2021, a remote code execution vulnerability (CVE-2021-44228) in Apache Log4j2 was disclosed. All versions of Apache Log4j from 2.0-beta9 to 2.15.0 (excluding security versions 2.12.2, 2.12.3, and 2.3.1) contain this vulnerability. Attackers using the identifier "${}" can trigger a JNDI injection vulnerability, allowing them to remotely execute code without authorization and gain control of the server. This vulnerability is highly dangerous, easy to exploit, and has a wide impact.

[0003] Currently, emergency response methods for the Apache Log4j2 remote code execution vulnerability are largely similar both domestically and internationally. Most recommend updating Log4j2 to version 2.15.1-rc2 or higher to fundamentally defend against this vulnerability. For users who cannot update their Log4j2 version temporarily, most adopt security measures by deploying third-party firewall products, updating WAF and RASP rules, and monitoring network traffic in real time to filter malicious requests.

[0004] However, due to the nature of the Apache Log4j2 remote code execution vulnerability, web application firewall rules still have shortcomings. Therefore, constructing diverse payloads for the Apache Log4j2 remote code execution vulnerability is of great significance for optimizing web application firewall rules. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing technologies by providing a top-down method for constructing Apache Log4j2 remote code execution statements.

[0006] The objective of this invention is achieved through the following technical solution:

[0007] A top-down method for constructing Apache Log4j2 remote code execution statements includes the following steps:

[0008] Step 1: Construct a data obfuscation rule set G, including an equivalent substitution rule set G. E Sensitive character replacement rule set G c and the meaningless dataset G U That is, G = (GE G c G U );

[0009] Step 2: Divide the Apache Log4j2 remote code execution statement S into 4 parts: identifier "${}", JNDI property name, JNDI accessible service, and access server IP address, and name them S1, S2, S3, S4, S4, S5, S6, S7, S8, S9, S10, S11, S12, S13, S14, S13, S14, S14, S15, S16, S17, S18, S17, S18, S19, S10 ... L S A S AS and S IP That is, S = {S} L ,S A ,S AS ,S IP};

[0010] Step 3: Use the data obfuscation rule set G to process S A S AS and S IP Perform top-down, layer-by-layer fine-grained obfuscation to sequentially obtain the S A S AS and S IP Fine-grained obfuscation of statement T A T AS and T IP Finally, a fine-grained obfuscated Apache Log4j2 remote code execution statement T = {S} is obtained. L ,T A ,T AS ,T IP}

[0011] Furthermore, using the data obfuscation rule set G, S A S AS and S IP When performing top-down, layer-by-layer fine-grained obfuscation, the equivalent substitution rule set G is used simultaneously. E Sensitive character replacement rule set G c and the meaningless dataset G U Perform fine-grained obfuscation layer by layer.

[0012] Furthermore, the equivalent substitution rule set G E It is used to generate diverse malicious data in Apache Log4j2 remote code execution statements;

[0013] The set of sensitive character replacement rules G c This is used to replace sensitive characters in Apache Log4j2 remote code execution statements;

[0014] The meaningless data set G UThis is used to increase the logical complexity of Apache Log4j2 remote code execution statements.

[0015] Furthermore, in step three, S A The statement T that completes the fine-grained obfuscation A The sub-steps are as follows:

[0016] (1) First, regarding S A A set A of n strings with a length not less than 1, i.e., A = {A...} i |=1,2,3,…,n}, where n<len(S A );

[0017] (2) According to the equivalent substitution rule set G E A for each element in A i Insert usable malicious data into it to generate a new string set A. E A E ={A Ei |=1,2,3,…,n};

[0018] (3) Replace the sensitive character rule set G c , for A E A for each element in Ei Replace sensitive characters in the code to reduce A. R Based on the degree of malice, a new string set A is generated. C A C ={A Ci |=1,2,3,…,n};

[0019] (4) Based on the meaningless dataset G U In A C A for each element in Ci Insert usable malicious data to generate a new string set A U A U ={A Ui |=1,2,3,…,n};

[0020] (5) Finally, string set A U splicing to generate pairs S A Fine-grained obfuscation of the completed string T A ;

[0021] By S AS To T AS By S IP To T IP Sub-steps and S A Get T A same.

[0022] Furthermore, according to the equivalent substitution rule set G E A for each element in A i When inserting usable malicious data, multiple equivalent replacement rules are used to insert malicious data layer by layer, generating a new string set A. E .

[0023] Furthermore, based on the meaningless dataset G U In A C A for each element in Ci Insert usable malicious data, select multiple meaningless data to insert, and generate a new string set A. U .

[0024] Compared with the prior art, the present invention has the following beneficial effects:

[0025] (1) String-level processing cannot support fine-grained analysis and obfuscation of Apache Log4j2 remote code execution statements. This invention uses a top-down approach to decompose Apache Log4j2 remote code execution statements step by step and obfuscate them layer by layer to complete the atomic level obfuscation operation of the statements.

[0026] (2) The present invention constructs an element storage method similar to a tree structure, which can flexibly handle the problem of analysis hierarchy and can dynamically perform obfuscation operations. Attached Figure Description

[0027] Figure 1 This is a flowchart of fine-grained obfuscation of Apache Log4j2 remote code execution statements.

[0028] Figure 2 It is the jndi attribute name S A An example of top-down, layer-by-layer fine-grained obfuscation. Detailed Implementation

[0029] The present invention will be described in detail below with reference to the accompanying drawings and preferred embodiments. The purpose and effects of the present invention will become clearer. It should be understood that the specific embodiments described herein are merely for explaining the present invention and are not intended to limit the present invention.

[0030] The present invention provides a top-down method for constructing Apache Log4j2 remote code execution statements. By decomposing Apache Log4j2 remote code execution statements, randomly splitting them into fine-grained segments, and obfuscating them layer by layer, a diverse range of Apache Log4j2 remote code execution statement samples can be constructed.

[0031] like Figure 1As shown, the top-down Apache Log4j2 remote code execution statement construction method of the present invention specifically includes the following steps:

[0032] (1) Construct a data confusion rule set G, including an equivalent substitution rule set G E Sensitive character replacement rule set G c and the meaningless dataset G U That is, G = (G E G c G U );

[0033] (2) Divide the Apache Log4j2 remote code execution statement S into four parts: identifier "${}", jndi property name, jndi accessible service, and access server IP address, and name them S1, S2, S3, S4, S5, S6, S7, S8, S9, S10, S11, S12, S13, S14, S13, S14, S14, S15, S16, S17, S18, S17, S18, S17, S18, S17, S18, S18, S19, S10 ... L S A S AS and S IP That is, S = {S} L ,S A ,S AS ,S IP};

[0034] For example, ${jndi:ldap: / / 127.0.0.1 / } consists of four parts: the identifier "${}", the jndi attribute name jndi, the service accessible by jndi ldap, and the access server IP address 127.0.0.1, which are respectively named S L S A S AS and S IP Finally, we get S = {${},jndi,ldap,127.0.0.1};

[0035] (3) Utilize the data obfuscation rule set G, where the three rule subsets S in the data obfuscation rule set are... A S AS and S IP Choose one or more rules for top-down, fine-grained obfuscation without any order of precedence, and select an equivalent substitution rule set G during obfuscation. E Sensitive character replacement rule set G c and the meaningless dataset G U By performing layer-by-layer obfuscation on any one or more of the following, a fine-grained obfuscated Apache Log4j2 remote code execution statement T = {S L ,T A ,T AS ,T IP}

[0036] In this embodiment, the case where all three rule subsets are used is selected, and G is utilized simultaneously. E G c G U To achieve the highest level of confusion, i.e., the case of S. A Perform top-down, layer-by-layer fine-grained obfuscation to obtain the statement T after fine-grained obfuscation. A The obfuscation process is illustrated with an example, such as... Figure 2 As shown, it includes:

[0037] (3.1) First, regarding S A A set A of n strings with a length not less than 1, i.e., A = {A...} i |i=1,2,3,…,n}, where n<len(S A For example, the attribute name kndi in jndi in this case can be divided into A = {j,nd,i};

[0038] (3.2) According to the equivalent substitution rule set G E A for each element in A i The malicious data is inserted layer by layer by selecting one or more available equivalent replacement rules to generate a new string set A. E A E ={${:-j},${data:"nd"},${:${data:"-j"}}};

[0039] (3.3) Replace according to sensitive character rule set G c , for A E A for each element in Ei Replace sensitive characters in the code to reduce A. E Based on the degree of malice, a new string set A is generated. C A C ={${${sys:path.separator}-j},${data:"nd"},${:${data:"-j"}}};

[0040] (3.4) Based on the meaningless dataset G U In A C A for each element in Ci Select one or more available meaningless data items to insert, generating a new string set A. U A U ={${${sys:path.separator}-j},${da${sys:sun.cpu.isalist}ta:"nd"},${:${data:"-j"}}};

[0041] (3.5) Finally, the string set A U splicing to generate pairs S A Fine-grained obfuscation of the completed string T A .

[0042] Following the method described in (3), the data confusion rule set G is used to process S. AS and S IP Perform top-down, layer-by-layer fine-grained obfuscation to sequentially obtain the S AS and S IP Fine-grained obfuscation of statement T AS and T IP Finally, a fine-grained obfuscated Apache Log4j2 remote code execution statement T = {S} is obtained. L ,T A ,T AS ,T IP}

[0043] It will be understood by those skilled in the art that the above descriptions are merely preferred examples of the invention and are not intended to limit the invention. Although the invention has been described in detail with reference to the foregoing examples, those skilled in the art can still modify the technical solutions described in the foregoing examples or make equivalent substitutions for some of the technical features. All modifications and equivalent substitutions made within the spirit and principles of the invention should be included within the scope of protection of the invention.

Claims

1. A top-down method for constructing Apache Log4j2 remote code execution statements, characterized in that, Includes the following steps: Step 1: Construct a set of data obfuscation rules Including the equivalent substitution rule set Sensitive character replacement rule set and meaningless datasets ,Right now ; Step 2: Execute Apache Log4j2 remote code statements It consists of four parts: the identifier "${}", the JNDI property name, the JNDI accessible service, and the access server IP address, which are named as follows: , , and ,Right now ; Step 3: Utilize the data obfuscation rule set ,right , and Perform top-down, layer-by-layer fine-grained confusion to sequentially obtain the... , and Fine-grained obfuscation of completed statements , and Ultimately, fine-grained obfuscated Apache Log4j2 remote code execution statements are obtained. ; In step three, by The statement that has been completed with fine-grained obfuscation The sub-steps are as follows: (1) First of all, Randomly divided into A collection of strings with a length of at least 1 character. ,Right now ,in, ; (2) According to the equivalent substitution rule set ,exist Each element in Insert usable malicious data into it to generate a new string set. ,Right now ; (3) Replace according to the sensitive character rule set ,right Each element in Replace sensitive characters in the text to reduce... The degree of malice determines the generation of a new string set. ,Right now ; (4) Based on the meaningless dataset ,exist Each element in Insert usable malicious data to generate a new string set. ,Right now ; (5) Finally, the string collection splicing to generate pairs Fine-grained obfuscation of the completed string ; Depend on arrive ,Depend on arrive Sub-steps and get same.

2. The method for constructing Apache Log4j2 remote code execution statements based on a top-down approach according to claim 1, characterized in that, Using data obfuscation rule sets ,right , and When performing top-down, layer-by-layer fine-grained obfuscation, the equivalent substitution rule set is utilized simultaneously. Sensitive character replacement rule set and meaningless datasets Perform fine-grained obfuscation layer by layer.

3. The method for constructing Apache Log4j2 remote code execution statements based on a top-down approach according to claim 1, characterized in that, The equivalent substitution rule set It is used to generate diverse malicious data in Apache Log4j2 remote code execution statements; The set of sensitive character replacement rules This is used to replace sensitive characters in Apache Log4j2 remote code execution statements; The meaningless data set This is used to increase the logical complexity of Apache Log4j2 remote code execution statements.

4. The method for constructing Apache Log4j2 remote code execution statements based on a top-down approach according to claim 1, characterized in that, According to the equivalent substitution rule set ,exist Each element in When inserting usable malicious data, multiple equivalent replacement rules are used to insert malicious data layer by layer, generating a new string set. .

5. The method for constructing Apache Log4j2 remote code execution statements based on a top-down approach according to claim 1, characterized in that, Based on the meaningless dataset ,exist Each element in Insert usable malicious data, select multiple meaningless data to insert, and generate a new string set. .

Images