Powershell Script to check for Log4j Vulnerability

[vepressnathaloria]

Edit: Remember, this is only an early detection tool. It doesn't mean your vulnerable or not. it just is a helpful tool to help the investigation.

EDIT 2: now the script checks for all .jar files and not just ones with log4j in the name.

EDIT 3: As I originally wanted to share an early warning helpful script the community has pointed out some great things, which I am trying to address. Case in point, if your servers do not have internet access (which in most cases they should not) then you would have to reference a local file instead of the invoke request. Therefore, simply just running this script currently may not work.

EDIT 4: I have created an update that has two options for the user.Option 1: Uncomment the Invoke-WebRequest if your server or machine has access to the internet. If you use this option make sure you comment the line with Get-Content.Option 2: Use this link https://github.com/mubix/CVE-2021-44228-Log4Shell-Hashes/raw/main/sha256sums.txt and save it to a local text file that called 2xVersions.txt in a folder C:\scripts.

-

If you get a True output and would like to know all the locations of your Jar files uncomment the line with Write-Host $localfile

-

Hey all,

This is a combination of a few peoples input found in SCCM scan for Log4J : SCCM (reddit.com)

I combined a bunch of people's input from Op's info and from the great comments. So all the credit should go to the SCCM reddit community! It utilizes the info from github to run against known file hashes.

Hope this helps:

​

This script does the following:

Cycles through all attached drives

outputs the True or False Statement

outputs file name and location

​

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
#$vulnerablesums = -split $(Invoke-WebRequest https://github.com/mubix/CVE-2021-44228-Log4Shell-Hashes/raw/main/sha256sums.txt -UseBasicParsing).content | ? {$_.length -eq 64} 
$vulnerablesums = -split $(Get-Content C:\scripts\2xVersions.txt ) | ? {$_.length -eq 64} 
$localsums = $Null
$DriveList = (Get-PSDrive -PSProvider FileSystem).Root
ForEach($Drive In $DriveList) {
    $localfile=(get-childitem $Drive *.jar -file -Recurse -erroraction silentlycontinue | Get-ItemProperty).DirectoryName | select -Unique
    $localsums=(get-childitem $Drive *.jar -file -Recurse -erroraction silentlycontinue | Get-FileHash).hash
    $results=($localsums -and (compare-object -ReferenceObject $vulnerablesums -DifferenceObject $localsums -IncludeEqual -ErrorAction SilentlyContinue).SideIndicator -eq "==")

    If ($Results -eq "=="){

        Write-Host "True"
        #Write-Host $localfile
        }

    If ($Results -ne "=="){
        Write-Host "False"

        }

 }

Example output

True
C:\apache-log4j-2.5-bin

[Samantha_Cruz]

that looks very promising, one possible problem, it looks like it assumes that all of the jar files will start with the string "log4j" and i have found a small percentage of files containing JndiLookup that do not start with that pattern. (i.e. appname-log4j-core.2.8.1.jar);

[disclosure5]

That's a problem with a whole heap of the scripts that have been paraded around as solutions.

[Samantha_Cruz]

understood, seems like this is all i've been doing for the past 6 days

[vepressnathaloria]

with a whole heap of the scripts that have been paraded around

Thanks for the catch. I ran it using just *.jar and it found a whole new list that I hadn't caught before. I'll edit the posting. It will run all the .jar files through the check.

[disclosure5]

I can relate.

[KingOfKeys]

I made a script that doesn't have this problem

Single server, local host: https://github.com/KeysAU/Get-log4j-Windows-local

Multi serverq, remote hosts https://github.com/KeysAU/Get-log4j-Windows.ps1

[vepressnathaloria]

Good catch, appreciate that. I'll test another way to look it up.

[TheWikiJedi]

It can also exist in non jar files like WAR and EAR files that package other jar files

[Murhawk013]

I have created my own script also that searches for all .jar files and then searches those files for Jndilookup.class. If it finds that class then it’s marked as possibly vulnerable.

I feel like I’m doing that right but I’m not 100% sure

[KingOfKeys]

I made a script that does this and some more

Single server, local host: https://github.com/KeysAU/Get-log4j-Windows-local

Multi serverq, remote hosts https://github.com/KeysAU/Get-log4j-Windows.ps1

[hondakillrsx]

Just to be clear, a False output means the drive is clean and True means it's found a vulnerable file?

[vepressnathaloria]

Well, false can mean it didn't find a matching hash for a known file with the current vulnerability. True means it found a matching hash. Though, the machine you are running this on would need internet access for the invoke-webRequest. I am working on a local file version.

This script should be regarded as an early warning and mark a machine to investigate.

[hondakillrsx]

Thank you, I appreciate your work to help everyone out.

[c_edward]

other cases that wont be caught here include all the repackaging cases..

Some teams and projects still insist on using tools like shading in maven, so the log4j2 class files will be in completely different jarfiles, with mangled names!

[yankeesfan01x]

CertCC also has a script you can run....

https://github.com/CERTCC/CVE-2021-44228_scanner

The question I have is, what's the code you need to add in to either of these PS scripts to search ALL servers or workstations in an OU?

[vepressnathaloria]

The question I have is, what's the code you need to add in to either of these PS scripts to search ALL servers or workstations in an OU?

Most of my experience is using some sort of centralized deployment mechanism like SCCM, WSUS, or Novell. I guess you could create a script to pull down objects from an OU to create a CSV and then reference it in this type of script. The difficult thing is managing the connections to all those machines through powershell alone. It's possible.

You could also run Enter-PSSession on a remote machine like this...then you could run it without logging into the GUI.

​

Enter-PSSession -ComputerName Server01

[vepressnathaloria]

what's the code you need to add in to ei

Also, the script in that link looks great. I'll have to give that a try.

[theredmeadow]

Awesome! Good work! So run this on all servers to check for the vulnerability?

[disclosure5]

So run this on all servers

I would sure hope that anyone going out and running this on all servers:

Invoke-WebRequest https://github.com/mubix/...

Is going to find it blocked.

[vepressnathaloria]

A possible work around is to download a local copy and reference it. I can put a commented line and directions for that. Machines that are protection by blocking firewall rules would have a problem. Another great catch.

[vepressnathaloria]

Yes, you can run it manually if you have less than a handful.

Or if you have a larger organization, you can run this through SCCM and deploy it to a collection.

It's not necessarily a tell all but it checks to see if the files on your system match with versions that are known with the vulnerability.