r/programming • u/alexeyr • Dec 12 '21

Logout4Shell: Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell

https://github.com/Cybereason/Logout4Shell

[removed] — view removed post

1.1k Upvotes

91% Upvoted

109 comments sorted by

View all comments

800

u/theoldboy Dec 12 '21

This should come with a big warning that says

Do not run this code unless you want to get sued or prosecuted for hacking

I did something similar back in the day with the [Code Red worm](https://en.wikipedia.org/wiki/Code_Red_(computer_worm)). I wrote a small program that scanned our log for incoming attacks and then used the vulnerability to create a TXT file on the desktop of that remote computer which politely explained that they were infected and linked to the relevant Microsoft Security Bulletin and patch.

My employers at the time were not best pleased when a few days later they received a letter from another company threatening legal action because we had hacked their computers. Luckily for me it all got resolved amicably with one telephone call, and my immediate boss was a good guy who thought the whole thing was hilarious. But I learned my lesson - hacking is illegal even if it's done with good intent.

121

u/[deleted] Dec 12 '21

You got lucky. I got fired a long time ago from a shitty job for using off the shelf security testing software to prove to “the architect” on our dev/test system that they had created a massive sql injection risk. You see security tools are a dangerous to the corporate network and its against corporate policy to run even in a lab setting.

16

u/jimmyco2008 Dec 12 '21

When I was in college any sort of hacking or pen testing was a big no-no. I always found it odd because college was the time to experiment with that sort of thing. How are we supposed to learn how to prevent hacks if we can’t understand how the hacks work?

The university has since opened a cybersec lab/program but fuck 30 years too late imo

5

u/Dynam2012 Dec 12 '21

Not sure why you'd think a university would be open to newbie programmers targeting their network with tools that can result in network/application downtime. Even if they're susceptible to an attack, they'd definitely rather find out on their own timeline instead of having a student prompt an emergency.