℉ⅈℕℹℸℽ @finity@qoto.org

#Apache Guacamole is the interface I deploy to let folks interact with the range easily. It is not easy to configure automatically... There's a simple user config file, but it is intentionally extremely simple. If you want to deploy Guacamole via configuration as code, you need something more powerful. I created this to do that:
https://github.com/kc0bfv/guacamoleREST

Jetty is kinda vulnerable... It doesn't use log4j logging by default, but it does come with a drop-in logging replacement module that uses log4j. By default... Even the current versions of Jetty for download will, when enabling this module, download vulnerable log4j. The people making Jetty don't seem to realize this yet. I have no idea if anyone uses the replacement module. But I did!

Solr is vulnerable if you grab the right version from Docker Hub (8.8.0 works nicely). But - the Java executable in there is from within the last few years, and those all disallow remote code includes via JNDI... So by default it's not going to give you RCE - at least not with the method commonly cited.

I learned some things.

Mostly done with my #log4shell range - Terraform and Ansible deploy it to AWS so you can play around with log4shell.

https://github.com/kc0bfv/log4j_range

https://youtu.be/jTM9-nudFBA

Great little short. #dust

Rough morning for somebody.

I35 in Kansas miles 40-60 always fly past. In either direction you come out of hours of placid plains into comparably dazzling suburbia of Wichita. I can't help but look around almost in wonder, my mind soaking in the distraction. By the time I catch my bearings we're out the other side driving through the fields again.

This party monster massacred the other decor...

Thanks Reddit

I spent way too long on Elastic given that their docs say it isn't exploitable due to mitigations... Oh well.

Spent a few hours last night trying to get #log4j RCE on fresh ElasticSearch, Jetty, and Solr (not enough time on this one) installs. But no luck.

Morning leaving Colorado

Support #EFF this week, and your donation will pack double the punch with an automatic 2X match... https://eff.org/power-up

Supreme court might eliminate RvW? Make it a law. That's the right way to do these things anyway. (I understand the complication around this, but if it's ever gonna happen this is the best time I've seen so far)