search

logpresso / CVE-2021-44228-Scanner

Vulnerability scanner and mitigation patch for Log4j2 CVE-2021-44228
Apache License 2.0
851 stars 174 forks source link

Feature request: Create Logfile #62

Closed MunteresRehlein closed 2 years ago

MunteresRehlein commented 2 years ago

It would be nice if a log file was created.

tp111 commented 2 years ago

Yes!!! That would be great and also to specify the log destination.

xeraph commented 2 years ago

@MunteresRehlein @tp111 Would you test v1.6.0 release? Use --report-csv and --report-path options.

image

tp111 commented 2 years ago

Great log!!! But would It be possible to include the HOSTNAME of the scanned computer and enable so results from several scanned servers could be saved in the same file? Then We could run the tool on several computers and collect results in one place.

tp111 commented 2 years ago

or if it's to hard to select result from several computers i one fil then add the Hostname to the log-file so that we could save all results to the same UNC path.

tp111 commented 2 years ago

@MunteresRehlein @tp111 Would you test v1.6.0 release? Use --report-csv and --report-path options.

image

I get Scan error when I run this command: log4j2-scan.exe --all-drives --report-csv --report-path C:\temp\VM075-Log4j-Scan-2021-12-15.csv

xeraph commented 2 years ago

@tp111 Really sorry.. Would you test using v1.6.1 again?

tp111 commented 2 years ago

@tp111 Really sorry.. Would you test using v1.6.1 again?

Great!!! Now this command works fine: log4j2-scan.exe --all-drives --report-csv --report-path C:\temp\VM075-Log4j-Scan-2021-12-15.csv

Only thing missing now is to include Hostname in the output and make the tool append results from scened computers. But maybe that's not possible. In that case it works fin with %computername% in the file-name and save the file in a UNC path. Have tested that and it works fine.

xeraph commented 2 years ago

@tp111 Just released v1.6.2 for hostname request :D

tp111 commented 2 years ago

@tp111 Just released v1.6.2 for hostname request :D

Ah, perfect!!! Could you dicribe how it works?

Because this command dosen't work anymore. Worked in 1.6.1:

log4j2-scan.exe --all-drives --report-csv --report-path \\Servername\Share$\temp\%computername%-Log4j-Scan-2021-12-15.csv
tp111 commented 2 years ago

ANd yes, there are two \. Don't know why one is missing efter posting the comment. When I try to Edit there are two \ in hte path.

tp111 commented 2 years ago

ANd yes, there are two . Don't know why one is missing efter posting the comment. When I try to Edit there are two \ in hte path.

log4j2-scan.exe --all-drives --report-csv --report-path \\Servername\Share$\temp\%computername%-Log4j-Scan-2021-12-15.csv

xeraph commented 2 years ago

@tp111 Hmm.. strange. I added following method: image Scanner reads environment variable and append it to CSV file. That's all.

tp111 commented 2 years ago

@tp111 Hmm.. strange. I added following method: image Scanner reads environment variable and append it to CSV file. That's all.

ok, but is it for appending the computername to the filename or to the result inside the file?

xeraph commented 2 years ago

@tp111 In the file. I will add hostname to output file path for you. Wait a moment..

tp111 commented 2 years ago

@tp111 In the file. I will add hostname to output file path for you. Wait a moment..

If the name is included inside the log then it's not neeaded in the filename.

xeraph commented 2 years ago

@tp111 I got it.

@tp111 In the file. I will add hostname to output file path for you. Wait a moment..

If the name is included inside the log then it's not neeaded in the filename.

tp111 commented 2 years ago

@tp111 Hmm.. strange. I added following method: image Scanner reads environment variable and append it to CSV file. That's all.

ok, but is it for appending the computername to the filename or to the result inside the file?

Sorry! It was my bad. It works great now. Thanks!

tp111 commented 2 years ago

Do you think that it would be possible to make the tool to append to the log-file instead of stopping if the log-file exists?

I'm thinking of a way to deploy it via SCCM end then report all results in to one csv-file. Don't know if that's possible but if it is that would be super nice.

Thank you for the great work!

xeraph commented 2 years ago

@tp111 Append option is possible. However, if multiple scanners run concurrently and writes report to one CSV file, CSV file will be messed up. (NFS file cannot be locked)

tp111 commented 2 years ago

@tp111 Append option is possible. However, if multiple scanners run concurrently and writes report to one CSV file, CSV file will be messed up. (NFS file cannot be locked)

I have one more request about the log. Could we have a option to only create log-file if there is something to report? Because if I scan 1000 servers I don't want to go over all 1000 log-files :)

tp111 commented 2 years ago

Also it would be great th have a suffix with date and time like in the default log that is created without the ---report-path parameter.

tp111 commented 2 years ago

@tp111 Append option is possible. However, if multiple scanners run concurrently and writes report to one CSV file, CSV file will be messed up. (NFS file cannot be locked)

Any news about --append-log or --overwrite-log? Would realy need that. Or at least a automatic suffix with date and time so that a new log is created instead of application failing as it does now when a Log-file exists.

romestylez commented 2 years ago

Maybe just use a batch like

REM Delete log if exist IF EXIST %~dp0\%computername%-Log4j-Scan.csv DEL /F %~dp0\%computername%-Log4j-Scan.csv %~dp0\log4j2-scan.exe --all-drives --silent --report-csv --report-path %~dp0\%computername%-Log4j-Scan.csv

And also i guess something like

%~dp0\log4j2-scan.exe --all-drives --silent --report-csv --report-path %~dp0\%computername%-%date%-Log4j-Scan.csv

should work also.

xeraph commented 2 years ago

@tp111 Append option is possible. However, if multiple scanners run concurrently and writes report to one CSV file, CSV file will be messed up. (NFS file cannot be locked)

I have one more request about the log. Could we have a option to only create log-file if there is something to report? Because if I scan 1000 servers I don't want to go over all 1000 log-files :)

@tp111 Added timestamp column and don't create empty file any more. Would you test v1.7.0?

tp111 commented 2 years ago

@tp111 Append option is possible. However, if multiple scanners run concurrently and writes report to one CSV file, CSV file will be messed up. (NFS file cannot be locked)

I have one more request about the log. Could we have a option to only create log-file if there is something to report? Because if I scan 1000 servers I don't want to go over all 1000 log-files :)

@tp111 Added timestamp column and don't create empty file any more. Would you test v1.7.0?

Well, thats great and it works but it still doesn't work when the log-file exists. So if you could add a parameter for append like --report-csv-append or something then every run could be append to the same log-file. Or add the timestamp to the end off the filename so that we get a new nog-file. Best if one could choose.

I guess I will have to create a wrapper script after all.

i286 commented 2 years ago

@tp111 Append option is possible. However, if multiple scanners run concurrently and writes report to one CSV file, CSV file will be messed up. (NFS file cannot be locked)

I have one more request about the log. Could we have a option to only create log-file if there is something to report? Because if I scan 1000 servers I don't want to go over all 1000 log-files :)

I am not sure about your tools you use, but having output to see that a scan even occured would be beneficial. Surely you are not reading 1000 logs manually individually. Combine them at least

xeraph commented 2 years ago

I will close this issue. You can create a new issue for further improvement.