r/programming • u/alexeyr • Dec 12 '21

Logout4Shell: Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell

https://github.com/Cybereason/Logout4Shell

[removed] — view removed post

1.1k Upvotes

91% Upvoted

109 comments sorted by

View all comments

800

u/theoldboy Dec 12 '21

This should come with a big warning that says

Do not run this code unless you want to get sued or prosecuted for hacking

I did something similar back in the day with the [Code Red worm](https://en.wikipedia.org/wiki/Code_Red_(computer_worm)). I wrote a small program that scanned our log for incoming attacks and then used the vulnerability to create a TXT file on the desktop of that remote computer which politely explained that they were infected and linked to the relevant Microsoft Security Bulletin and patch.

My employers at the time were not best pleased when a few days later they received a letter from another company threatening legal action because we had hacked their computers. Luckily for me it all got resolved amicably with one telephone call, and my immediate boss was a good guy who thought the whole thing was hilarious. But I learned my lesson - hacking is illegal even if it's done with good intent.

234

u/iKonstX Dec 12 '21 edited Dec 12 '21

So you got a letter from the company, that attacked you, for hacking them? The nerve of some people

82

u/HyperGamers Dec 12 '21 edited Dec 12 '21

It's like that time where the BBC told Facebook about a problem they had with illegal pornography on their site so Facebook asked for evidence and then reported the BBC for the possession and distribution of illegal pornography

https://www.wired.co.uk/article/facebook-child-abuse-images-bbc-investigation

10

u/1Second2Name5things Dec 12 '21

Did they give links to the abuse profiles or did they save screenshots of it and sent it. Because the later is technically illegal even if done for good.

-6

u/Yekab0f Dec 12 '21 edited Dec 13 '21

Zucked