对Log4Shell CVE-2021-44228 应急响应

2021-12-21 19:30:04 浏览数 (1)

PCRE RegEx 在您的日志中匹配 Log4Shell CVE-2021-44228 IOC

正则表达式：

代码语言：javascript复制
(? im ) (?: ^ | [ n ] )。* ? (?: [ x 24 ] | % (?: 25%? ) * 24 | \ u?0 * (?: 44 | 24 ) ) (?: [ x 7b ] | % (?: 25%? ) * 7b | \ u?0 * (?: 7b | 173 ) ) [^ n ] * ? ( (?: j | % (?: 25%? ) * (?: 4a | 6a ) | \ u?0 * (?: 112 | 6a | 4a | 152 ) ) [ ^ n ] * ? (? : n | % (?: 25%? ) * (?: 4e | 6e ) | \ u?0 * (?: 4e| 156 | 116 | 6e ) ) [ ^ n ] * ? (?: d | % (?: 25%? ) * (?: 44 | 64 ) | \ u?0 * (?: 44 | 144 | 104 | 64 ) ) [ ^ n ] * ? (?: [ i x {130} x {131} ] | % (?:25%？) * (?: 49 | 69 | C4% (?: 25%? ) * B0 | C4% (?: 25%? ) * B1 ) | \ u?0 * (?: 111 | 69 | 49 | 151 | 130 | 460 | 131 | 461 ) ) [ ^ n ] * ? (?: [ x 3a ] | %(?: 25%? ) * 3a | \ u?0 * (?: 72 | 3a ) ) [ ^ n ] * ? ( (?: l | % (?: 25%? ) * (?: 4c | 6c ) | \ u?0 * (?: 154 | 114 | 6c | 4c ) ) [ ^ n ] * ? (? : d |% (?: 25%? ) * (?: 44 | 64 ) | \ u?0 * (?: 44 | 144 | 104 | 64 ) ) [ ^ n ] * ? (?: a | % (?: 25%? ) * (?: 41 | 61 ) | \ u?0 * (?: 101 | 61 | 41 | 141 ) ) [^ n ] * ? (?: p | % (?: 25%? ) * (?: 50 | 70 ) | \ u?0 * (?: 70 | 50 | 160 | 120 ) ) (?: [ ^ n ] * ? (?: [ s x {17f} ] | % (?: 25%? ) * (?: 53 | 73 | C5% (?:25%？) * BF ) | \ u?0 * (?: 17f | 123 | 577 | 73 | 53 | 163 ) ) ) ? | (?: r | % (?: 25%? ) * (?: 52 | 72 ) | \ u?0 * (?: 122 | 72 | 52 | 162 ) ) [ ^ n ] *? (?: m | % (?: 25%? ) * (?: 4d | 6d ) | \ u?0 * (?: 4d | 155 | 115 | 6d ) ) [ ^ n ] * ? (?: [ i x {130} x {131} ] | % (?: 25%? ) * (?: 49 | 69 | C4% (?: 25%? )* B0 | C4% (?: 25%? ) * B1 ) | \ u?0 * (?: 111 | 69 | 49 | 151 | 130 | 460 | 131 | 461 ) ) | (?: d | % (?: 25%? ) * (?: 44 | 64 ) | \ u?0 * (?: 44 | 144 | 104 |64 ) ) [ ^ n ] *？(?: n | % (?: 25%? ) * (?: 4e | 6e ) | \ u?0 * (?: 4e | 156 | 116 | 6e ) ) [ ^ n ] * ? (?: [ s x {17f} ] | % (?: 25%? ) * (?: 53 | 73| C5% (?: 25%? ) * BF ) | \ u?0 * (?: 17f | 123 | 577 | 73 | 53 | 163 ) ) | (?: n | % (?: 25%? ) * (?: 4e | 6e ) | \ u?0 * (?: 4e | 156 | 116 | 6e ) ) [ ^ n ]* ? (?: [ i x {130} x {131} ] | % (?: 25%? ) * (?: 49 | 69 | C4% (?: 25%? ) * B0 | C4% (?: 25%? ) * B1 ) | \ u?0 * (?: 111 | 69 | 49 | 151 | 130 | 460 | 131 | 461 ) )[ ^ n ] * ? (?: [ s x {17f} ] | % (?: 25%? ) * (?: 53 | 73 | C5% (?: 25%? ) * BF ) | \ u?0 * (?: 17f | 123 | 577 | 73 | 53 | 163 ) ) | (?: [ ^ n ] * ? (?: [i x {130} x {131} ] | % (?: 25%? ) * (?: 49 | 69 | C4% (?: 25%? ) * B0 | C4% (?: 25%? ) * B1 ) | \ u?0 * (?: 111 | 69 | 49 | 151 | 130 | 460 | 131 | 461 ) ) ) { 2 }[ ^ n ] * ? (?: o | % (?: 25%? ) * (?: 4f | 6f ) | \ u?0 * (?: 6f | 4f | 157 | 117 ) ) [ ^ n ] * ? (?: p | % (?: 25%? ) * (?: 50 | 70 ) | \ u?0 * (?: 70| 50 | 160 | 120 ））| (?: c | % (?: 25%? ) * (?: 43 | 63 ) | \ u?0 * (?: 143 | 103 | 63 | 43 ) ) [ ^ n ] * ? (?: o | % (?: 25%? ) * (?: 4f | 6f ) | \ u?0* (?: 6f | 4f | 157 | 117 ) ) [ ^ n ] * ? (?: r | % (?: 25%? ) * (?: 52 | 72 ) | \ u?0 * (?: 122 | 72 | 52 | 162 ) ) [ ^ n ] * ? (?: b | % (?: 25%? ) *(?: 42 | 62 ) | \ u?0 * (?: 102 | 62 | 42 | 142 ) ) [ ^ n ] * ? (?: a | % (?: 25%? ) * (?: 41 | 61 ) | \ u?0 * (?: 101 | 61 | 41 | 141 ) ) | (?: n | % (?:25%？) * (?: 4e | 6e ) | \ u?0 * (?: 4e | 156 | 116 | 6e ) ) [ ^ n ] * ? (?: d | % (?: 25%? ) * (?: 44 | 64 ) | \ u?0 * (?: 44 | 144 | 104 | 64 ) ) [ ^ n] * ? (?: [ s x {17f} ] | % (?: 25%? ) * (?: 53 | 73 | C5% (?: 25%? ) * BF ) | \ u?0 * (?: 17f | 123 | 577 | 73 | 53 | 163 ) ) | (?: h | % (?: 25%? ) * (?: 48 |68 ) | \ u?0 * (?: 110 | 68 | 48 | 150 ) ) (?: [ ^ n ] * ? (?: t | % (?: 25%? ) * (?: 54 | 74 ) | \ u?0 * (?: 124 | 74 | 54 | 164 ) ) ) { 2 } [ ^ n ]* ? (?: p | % (?: 25%? ) * (?: 50 | 70 ) | \ u?0 * (?: 70 | 50 | 160 | 120 ) ) (?: [ ^ n ] * ? (?: [ s x {17f} ] | % (?: 25%? ) * (?: 53 | 73 | C5% (?: 25%? ) *BF ) | \ u?0 * (?: 17f | 123 | 577 | 73 | 53 | 163 ) ) ) ? ) [ ^ n ] * ? (?: [ x 3a ] | % (?: 25%? ) * 3a | \ u?0 * (?: 72 | 3a ) ) | (?: b | % (?: 25%?) * (?: 42 | 62 ) | \ u?0 * (?: 102 | 62 | 42 | 142 ) ) [ ^ n ] * ? (?: a | % (?: 25%? ) * (?: 41 | 61 ) | \ u?0 * (?: 101 | 61 | 41 | 141 ) ) [ ^ n ]* ? (?: [ s x {17f} ] | % (?: 25%? ) * (?: 53 | 73 | C5% (?: 25%? ) * BF ) | \ u?0 * (?: 17f | 123 | 577 | 73 | 53 | 163 ) ) [ ^ n ] * ? (?: e | % (?: 25%? ) *(?: 45 | 65 ) | \ u?0 * (?: 45 | 145 | 105 | 65 ) ) [ ^ n ] * ? (?: [ x 3a ] | % (?: 25%? ) * 3a | \ u?0 * (?: 72 | 3a ) ) ( JH [ sv ] | [ x 2b x 2f-9A-扎-z] [ CSiy ] R7 | [ x 2b x 2f-9A-Za-z ] { 2 } [ 048AEIMQUYcgkosw ] ke [ x 2b x 2f-9w-z ] ) )

这个正则表达式匹配漏洞利用：

  • 不区分大小写（也在所有支持的编码中）
  • Url编码
  • 递归 URL 编码
  • 使用 Unicode 编码
  • 八进制编码
  • Base64 编码

Linux 机器上使用

在 CLI 上 grep

代码语言：javascript复制
eval  " $( ./RegEx_Generator.sh ) " 
grep -P ${Log4ShellRex}  <logfile>
代码语言：javascript复制
grep -P '(?im)(?:^|[n]).*?(?:[x24]|%(?:25%?)*24|\u?0*(?:44 |24))(?:[x7b]|%(?:25%?)*7b|\u?0*(?:7b|173))[^n]*?((?:j| %(?:25%?)*(?:4a|6a)|\u?0*(?:112|6a|4a|152))[^n]*?(?:n|%(? :25%?)*(?:4e|6e)|\u?0*(?:4e|156|116|6e))[^n]*?(?:d|%(?:25%) ?)*(?:44|64)|\u?0*(?:44|144|104|64))[^n]*?(?:[ix{130}x{131 }]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\u?0* (?:111|69|49|151|130|460|131|461))[^n]*?(?:[x3a]|%(?:25%?)*3a|\u? 0*(?:72|3a))[^n]*?((?:l|%(?:25%?)*(?:4c|6c)|\u?0*(?:154 |114|6c|4c))[^n]*?(?:d|%(?:25%?)*(?:44|64)|\u?0*(?:44|144| 104|64))[^n]*?(?:a|%(?:25%?)*(?:41|61)|\u?0*(?:101|61|41|141 ))[^n]*?(?:p|%(?:25%?)*(?:50|70)|\u?0*(?:70|50|160|120))( ?:[^n]*?(?:[sx{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)| \u?0*(?:17f|123|577|73|53|163)))?|(?:r|%(?:25%?)*(?:52|72)|\u ?0*(?:122|72|52|162))[^n]*?(?:m|%(?:25%?)*(?:4d|6d)|\u?0* （？：4d|155|115|6d))[^n]*?(?:[ix{130}x{131}]|%(?:25%?)*(?:49|69|C4 %(?:25%?)*B0|C4%(?:25%?)*B1)|\u?0*(?:111|69|49|151|130|460|131|461)) |(?:d|%(?:25%?)*(?:44|64)|\u?0*(?:44|144|104|64))[^n]*?(? :n|%(?:25%?)*(?:4e|6e)|\u?0*(?:4e|156|116|6e))[^n]*?(?:[s x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\u?0*(?:17f|123|577 |73|53|163))|(?:n|%(?:25%?)*(?:4e|6e)|\u?0*(?:4e|156|116|6e))[ ^n]*?(?:[ix{130}x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0 |C4%(?:25%?)*B1)|\u?0*(?:111|69|49|151|130|460|131|461))[^n]*?(?: [sx{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\u?0*(?:17f|123 |577|73|53|163))|(?:[^n]*?(?:[ix{130}x{131}]|%(?:25%?)*(?: 49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\u?0*(?:111|69|49|151|130|460| 131|461))){2}[^n]*?(?:o|%(?:25%?)*(?:4f|6f)|\u?0*(?:6f|4f |157|117))[^n]*?(?:p|%(?:25%?)*(?:50|70)|\u?0*(?:70|50|160| 120))|(?:c|%(?:25%?)*(?:43|63)|\u?0*(?:143|103|63|43))[^n]*?(?:o|%(?:25%?)*(?:4f|6f)|\u?0*(?:6f|4f |157|117))[^n]*?(?:r|%(?:25%?)*(?:52|72)|\u?0*(?:122|72|52| 162))[^n]*?(?:b|%(?:25%?)*(?:42|62)|\u?0*(?:102|62|42|142)) [^n]*?(?:a|%(?:25%?)*(?:41|61)|\u?0*(?:101|61|41|141))|(? :n|%(?:25%?)*(?:4e|6e)|\u?0*(?:4e|156|116|6e))[^n]*?(?:d| %(?:25%?)*(?:44|64)|\u?0*(?:44|144|104|64))[^n]*?(?:[sx{ 17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\u?0*(?:17f|123|577|73| 53|163))|(?:h|%(?:25%?)*(?:48|68)|\u?0*(?:110|68|48|150))(?:[ ^n]*?(?:t|%(?:25%?)*(?:54|74)|\u?0*(?:124|74|54|164))){2} [^n]*?(?:p|%(?:25%?)*(?:50|70)|\u?0*(?:70|50|160|120))(?: [^n]*?(?:[sx{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\ u?0*(?:17f|123|577|73|53|163)))?)[^n]*?(?:[x3a]|%(?:25%?)*3a| u?0*(?:72|3a))|(?:b|%(?:25%?)*(?:42|62)|\u?0*(?:102|62|42 |142))[^n]*?(?:a|%(?:25%?)*(?:41|61)|\u?0*(?:101|61|41|141) )[^n]*?(?:[sx{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\u?0*(?:17f|123 |577|73|53|163))[^n]*?(?:e|%(?:25%?)*(?:45|65)|\u?0*(?:45| 145|105|65))[^n]*?(?:[x3a]|%(?:25%?)*3a|\u?0*(?:72|3a))(JH[ sv]|[x2bx2f-9A-Za-z][CSiy]R7|[x2bx2f-9A-Za-z]{2}[048AEIMQUYcgkosw]ke[x2bx2f-9w-z]) )' <logfile>

使用 Splunk 搜索您的日志

您可以使用此 RegEx 使用| regex SPL命令搜索索引日志

代码语言：javascript复制
index=<...> sourcetype=<...>
| regex "<Log4ShellRex>"
代码语言：javascript复制
index=<...> sourcetype=<...>
| regex "(?im)(?:^|[\n]).*?(?:[\x24]|%(?:25%?)*24|\\u?0*(?:44|24))(?:[\x7b]|%(?:25%?)*7b|\\u?0*(?:7b|173))[^\n]*?((?:j|%(?:25%?)*(?:4a|6a)|\\u?0*(?:112|6a|4a|152))[^\n]*?(?:n|%(?:25%?)*(?:4e|6e)|\\u?0*(?:4e|156|116|6e))[^\n]*?(?:d|%(?:25%?)*(?:44|64)|\\u?0*(?:44|144|104|64))[^\n]*?(?:[i\x{130}\x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\u?0*(?:111|69|49|151|130|460|131|461))[^\n]*?(?:[\x3a]|%(?:25%?)*3a|\\u?0*(?:72|3a))[^\n]*?((?:l|%(?:25%?)*(?:4c|6c)|\\u?0*(?:154|114|6c|4c))[^\n]*?(?:d|%(?:25%?)*(?:44|64)|\\u?0*(?:44|144|104|64))[^\n]*?(?:a|%(?:25%?)*(?:41|61)|\\u?0*(?:101|61|41|141))[^\n]*?(?:p|%(?:25%?)*(?:50|70)|\\u?0*(?:70|50|160|120))(?:[^\n]*?(?:[s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123|577|73|53|163)))?|(?:r|%(?:25%?)*(?:52|72)|\\u?0*(?:122|72|52|162))[^\n]*?(?:m|%(?:25%?)*(?:4d|6d)|\\u?0*(?:4d|155|115|6d))[^\n]*?(?:[i\x{130}\x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\u?0*(?:111|69|49|151|130|460|131|461))|(?:d|%(?:25%?)*(?:44|64)|\\u?0*(?:44|144|104|64))[^\n]*?(?:n|%(?:25%?)*(?:4e|6e)|\\u?0*(?:4e|156|116|6e))[^\n]*?(?:[s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123|577|73|53|163))|(?:n|%(?:25%?)*(?:4e|6e)|\\u?0*(?:4e|156|116|6e))[^\n]*?(?:[i\x{130}\x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\u?0*(?:111|69|49|151|130|460|131|461))[^\n]*?(?:[s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123|577|73|53|163))|(?:[^\n]*?(?:[i\x{130}\x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\u?0*(?:111|69|49|151|130|460|131|461))){2}[^\n]*?(?:o|%(?:25%?)*(?:4f|6f)|\\u?0*(?:6f|4f|157|117))[^\n]*?(?:p|%(?:25%?)*(?:50|70)|\\u?0*(?:70|50|160|120))|(?:c|%(?:25%?)*(?:43|63)|\\u?0*(?:143|103|63|43))[^\n]*?(?:o|%(?:25%?)*(?:4f|6f)|\\u?0*(?:6f|4f|157|117))[^\n]*?(?:r|%(?:25%?)*(?:52|72)|\\u?0*(?:122|72|52|162))[^\n]*?(?:b|%(?:25%?)*(?:42|62)|\\u?0*(?:102|62|42|142))[^\n]*?(?:a|%(?:25%?)*(?:41|61)|\\u?0*(?:101|61|41|141))|(?:n|%(?:25%?)*(?:4e|6e)|\\u?0*(?:4e|156|116|6e))[^\n]*?(?:d|%(?:25%?)*(?:44|64)|\\u?0*(?:44|144|104|64))[^\n]*?(?:[s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123|577|73|53|163))|(?:h|%(?:25%?)*(?:48|68)|\\u?0*(?:110|68|48|150))(?:[^\n]*?(?:t|%(?:25%?)*(?:54|74)|\\u?0*(?:124|74|54|164))){2}[^\n]*?(?:p|%(?:25%?)*(?:50|70)|\\u?0*(?:70|50|160|120))(?:[^\n]*?(?:[s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123|577|73|53|163)))?)[^\n]*?(?:[\x3a]|%(?:25%?)*3a|\\u?0*(?:72|3a))|(?:b|%(?:25%?)*(?:42|62)|\\u?0*(?:102|62|42|142))[^\n]*?(?:a|%(?:25%?)*(?:41|61)|\\u?0*(?:101|61|41|141))[^\n]*?(?:[s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123|577|73|53|163))[^\n]*?(?:e|%(?:25%?)*(?:45|65)|\\u?0*(?:45|145|105|65))[^\n]*?(?:[\x3a]|%(?:25%?)*3a|\\u?0*(?:72|3a))(JH[s-v]|[\x2b\x2f-9A-Za-z][CSiy]R7|[\x2b\x2f-9A-Za-z]{2}[048AEIMQUYcgkosw]ke[\x2b\x2f-9w-z]))"

grep -P

Splunk

项目地址：

https://github.com/back2root/log4shell-rex

grep 正则表达式 regex shell javascript

0 人点赞