bolt_log4j

A bolt plan which makes use of Google's log4jscanner to allow scanning of Windows and Linux hosts at scale for the log4shell vulnerability.

Table of Contents

1. Description
2. Setup - The basics of getting started with bolt_log4j
   • What bolt_log4j affects
   • Setup requirements
   • Beginning with bolt_log4j
3. Usage - Configuration options and additional functionality
4. Limitations - OS compatibility, etc.
5. Development - Guide for contributing to the module

Description

A bolt plan which make use of Google's log4jscanner to allow scanning of Windows and Linux hosts at scale for the log4shell vulnerability.

Setup

What bolt_log4j affects

Bolt_log4j makes the following changes on systems.

• Installs Puppet agent binaries.
• Extracts the log4jscanner. By default it uses the following paths.
  • Windows: c:\
  • Linux: /tmp
• Executes the log4jscanner on the system. By default it scans the following paths
  • Windows: c:\
  • Linux /

Setup Requirements

bolt_log4j requires Puppet Bolt to be installed on the scanning machine only.

Run bolt_log4j from a machine with access to the hosts you wish to scan. Port TCP/22 (SSH - Linux) and TCP/5985, TCP/5986 (WinRM - Windows) need to be open from the scanning machine to the target machines. Root or administrator credentials are also required for the target hosts. For Linux systems, a SSH key pair is recommended.

Beginning with bolt_log4j

1. Install Puppet Bolt
2. Create a directory for bolt project. mkdir log4j_scanner
3. Change into project directory. cd log4j_scanner
4. Init a new bolt project. bolt project init
5. Open the bolt-project.yaml. Update it to include the bolt_log4j module as shown.

modules:
  - git: https://github.com/benjamin-robertson/bolt_log4j.git
    ref: 'main'

6. Install the module and its dependencies by running bolt module install. Hint: If you need to force a refresh of modules you can run. bolt module install --force
7. Confirm plan is installed by running. bolt plan show. Confirm the bolt_log4j::vuln plan is present.
8. Configure bolt inventory.yaml file as shown. You will most likely need to customize these options for your own environment, see transport options.

---
config:
  transport: ssh
  ssh:
    user: ec2-user
    host-key-check: false
    native-ssh: true
    private-key: /home/ubuntu/.ssh/id_rsa.pem
    ssh-command: /usr/bin/ssh
groups:
  - name: rhel
    targets:
      - ip-10-64-61-143.ap-southeast-2.compute.internal
      - ip-10-64-229-181.ap-southeast-2.compute.internal
  - name: ubuntu
    targets:
      - 10.64.41.234
      - 10.64.214.252
      - 10.64.117.212
    config:
      ssh:
        user: ubuntu
  - name: windows
    targets:
      - 10.64.149.16
    config:
      transport: winrm
      winrm:
        user: tempadmin
        password: <your_password>
        ssl: false

9. To confirm connectivity to hosts in a group, you can use the facts plan. bolt plan run facts targets=windows

Usage

To run bolt_log4j::vuln plan, run the following command. Specify target group from your inventory file.

bolt plan run bolt_log4j::vuln targets=<target group> --connect-timeout=45

For Windows hosts, best to set the connection timeout to 45 seconds. I have seen occasions where Windows systems have been slow to respond, resulting in timeouts. Linux systems are okay with standard timeout. Timeout can also be set in inventory.yaml.

Limitations

Timeout should be increased from the 15 second default for Windows systems. See above.

Expected to work on all modern Windows, RHEL and Ubuntu systems.

Development

If you find any issues with this module, please log them in the issues register of the GitHub project. Issues

PR's glady accepted.

Reference

Table of Contents

Plans

• bolt_log4j::vuln: Bolt plan to detect hosts vulnerable to log4shell.

Plans

bolt_log4j::vuln

lint:ignore:140chars

Parameters

The following parameters are available in the bolt_log4j::vuln plan:

• targets
• windows_install_path
• linux_install_path
• windows_scan_path
• linux_scan_path

targets

Data type: TargetSpec

The targets to run on.

windows_install_path

Data type: Stdlib::Windowspath

File path to install the log4j scanner on windows.

Default value: 'c:\\'

linux_install_path

Data type: Stdlib::Unixpath

File path to install the log4j scanner on Linux.

Default value: '/tmp'

windows_scan_path

Data type: Stdlib::Windowspath

File systems path to scan on Windows. Will scan recursively from this directory.

Default value: 'c:\\'

linux_scan_path

Data type: Stdlib::Unixpath

File systems path to scan on Linux. Will scan recursively from this directory.

Default value: '/'

Changelog

All notable changes to this project will be documented in this file.

Release 0.1.0

Features

Bugfixes

Known Issues