search

puzzlepeaches / Log4jUnifi

Exploiting CVE-2021-44228 in Unifi Network Application for remote code execution and more.
140 stars 29 forks source link

failed to solve: process "/bin/sh -c mvn package -f /Log4jUnifi/utils/rogue-jndi/" did not complete successfully #4

Closed Drjacky closed 9 months ago

Drjacky commented 9 months ago 
➜  Log4jUnifi git:(main) docker build -t log4junifi .
[+] Building 10.8s (9/10)                                                                                                                                          docker:default
 => [internal] load build definition from Dockerfile                                                                                                                         0.0s
 => => transferring dockerfile: 317B                                                                                                                                         0.0s
 => [internal] load .dockerignore                                                                                                                                            0.0s
 => => transferring context: 2B                                                                                                                                              0.0s
 => [internal] load metadata for docker.io/library/alpine:latest                                                                                                             2.6s
 => [internal] load build context                                                                                                                                            0.0s
 => => transferring context: 45.26kB                                                                                                                                         0.0s
 => [1/6] FROM docker.io/library/alpine@sha256:51b67269f354137895d43f3b3d810bfacd3945438e94dc5ac55fdac340352f48                                                              0.5s
 => => resolve docker.io/library/alpine@sha256:51b67269f354137895d43f3b3d810bfacd3945438e94dc5ac55fdac340352f48                                                              0.0s
 => => sha256:51b67269f354137895d43f3b3d810bfacd3945438e94dc5ac55fdac340352f48 1.64kB / 1.64kB                                                                               0.0s
 => => sha256:a70bcfbd89c9620d4085f6bc2a3e2eef32e8f3cdf5a90e35a1f95dcbd7f71548 528B / 528B                                                                                   0.0s
 => => sha256:1dc785547989b0db1c3cd9949c57574393e69bea98bfe044b0588e24721aa402 1.49kB / 1.49kB                                                                               0.0s
 => => sha256:c303524923177661067f7eb378c3dd5277088c2676ebd1cd78e68397bb80fdbf 3.35MB / 3.35MB                                                                               0.4s
 => => extracting sha256:c303524923177661067f7eb378c3dd5277088c2676ebd1cd78e68397bb80fdbf                                                                                    0.1s
 => [2/6] ADD . /Log4jUnifi                                                                                                                                                  0.0s
 => [3/6] RUN apk update &&     apk add git openjdk11 py3-pip python3 maven                                                                                                  7.4s
 => [4/6] WORKDIR /Log4jUnifi                                                                                                                                                0.0s
 => ERROR [5/6] RUN mvn package -f /Log4jUnifi/utils/rogue-jndi/                                                                                                             0.8s
------
 > [5/6] RUN mvn package -f /Log4jUnifi/utils/rogue-jndi/:
0.764 [INFO] Scanning for projects...
0.767 [ERROR] [ERROR] Some problems were encountered while processing the POMs:
0.767 [FATAL] Non-readable POM /Log4jUnifi/utils/rogue-jndi/pom.xml: /Log4jUnifi/utils/rogue-jndi/pom.xml (No such file or directory) @
0.767  @
0.769 [ERROR] The build could not read 1 project -> [Help 1]
0.769 [ERROR]
0.769 [ERROR]   The project  (/Log4jUnifi/utils/rogue-jndi/pom.xml) has 1 error
0.769 [ERROR]     Non-readable POM /Log4jUnifi/utils/rogue-jndi/pom.xml: /Log4jUnifi/utils/rogue-jndi/pom.xml (No such file or directory)
0.769 [ERROR]
0.770 [ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
0.770 [ERROR] Re-run Maven using the -X switch to enable full debug logging.
0.770 [ERROR]
0.770 [ERROR] For more information about the errors and possible solutions, please read the following articles:
0.770 [ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/ProjectBuildingException
------
Dockerfile:6
--------------------
   4 |         apk add git openjdk11 py3-pip python3 maven
   5 |     WORKDIR /Log4jUnifi
   6 | >>> RUN mvn package -f /Log4jUnifi/utils/rogue-jndi/
   7 |     RUN pip3 install -r requirements.txt
   8 |     ENTRYPOINT ["python3","exploit.py"]
--------------------
ERROR: failed to solve: process "/bin/sh -c mvn package -f /Log4jUnifi/utils/rogue-jndi/" did not complete successfully: exit code: 1
Drjacky commented 9 months ago 
➜  Log4jUnifi git:(main) mvn package -f /Log4jUnifi/utils/rogue-jndi/

POM file /Log4jUnifi/utils/rogue-jndi/ specified with the -f/--file command line argument does not exist
[INFO] Scanning for projects...
[ERROR] [ERROR] Some problems were encountered while processing the POMs:
[FATAL] Non-readable POM /Log4jUnifi/utils/rogue-jndi: /Log4jUnifi/utils/rogue-jndi (No such file or directory) @
 @
[ERROR] The build could not read 1 project -> [Help 1]
[ERROR]
[ERROR]   The project  (/Log4jUnifi/utils/rogue-jndi) has 1 error
[ERROR]     Non-readable POM /Log4jUnifi/utils/rogue-jndi: /Log4jUnifi/utils/rogue-jndi (No such file or directory)
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/ProjectBuildingException
Drjacky commented 9 months ago

git clone --recurse-submodules https://github.com/puzzlepeaches/Log4jUnifi

Drjacky commented 9 months ago 
=> [5/6] RUN mvn package -f /Log4jUnifi/utils/rogue-jndi/                                                                                                                   9.1s
 => ERROR [6/6] RUN pip3 install -r requirements.txt                                                                                                                         0.9s
------
 > [6/6] RUN pip3 install -r requirements.txt:
0.687 error: externally-managed-environment
0.687
0.687 × This environment is externally managed
0.687 ╰─>
0.687     The system-wide python installation should be maintained using the system
0.687     package manager (apk) only.
0.687
0.687     If the package in question is not packaged already (and hence installable via
0.687     "apk add py3-somepackage"), please consider installing it inside a virtual
0.687     environment, e.g.:
0.687
0.687     python3 -m venv /path/to/venv
0.687     . /path/to/venv/bin/activate
0.687     pip install mypackage
0.687
0.687     To exit the virtual environment, run:
0.687
0.687     deactivate
0.687
0.687     The virtual environment is not deleted, and can be re-entered by re-sourcing
0.687     the activate file.
0.687
0.687     To automatically manage virtual environments, consider using pipx (from the
0.687     pipx package).
0.687
0.687 note: If you believe this is a mistake, please contact your Python installation or OS distribution provider. You can override this, at the risk of breaking your Python installation or OS, by passing --break-system-packages.
0.687 hint: See PEP 668 for the detailed specification.
------
Dockerfile:7
--------------------
   5 |     WORKDIR /Log4jUnifi
   6 |     RUN mvn package -f /Log4jUnifi/utils/rogue-jndi/
   7 | >>> RUN pip3 install -r requirements.txt
   8 |     ENTRYPOINT ["python3","exploit.py"]
   9 |
--------------------
ERROR: failed to solve: process "/bin/sh -c pip3 install -r requirements.txt" did not complete successfully: exit code: 1
➜  Log4jUnifi git:(main) ls
Dockerfile       README.md        exploit.py       requirements.txt utils

Then:

➜  Log4jUnifi git:(main) pip3 install -r requirements.txt
WARNING: Skipping /opt/homebrew/lib/python3.11/site-packages/PyQt6-6.5.1.dist-info due to invalid metadata entry 'name'
WARNING: Skipping /opt/homebrew/lib/python3.11/site-packages/PyQt6-6.5.1.dist-info due to invalid metadata entry 'name'
DEPRECATION: Loading egg at /opt/homebrew/lib/python3.11/site-packages/graphqlmap-0.0.1-py3.11.egg is deprecated. pip 24.3 will enforce this behaviour change. A possible replacement is to use pip for package installation.. Discussion can be found at https://github.com/pypa/pip/issues/12330
Requirement already satisfied: requests in /opt/homebrew/lib/python3.11/site-packages (from -r requirements.txt (line 1)) (2.31.0)
Requirement already satisfied: charset-normalizer<4,>=2 in /opt/homebrew/lib/python3.11/site-packages (from requests->-r requirements.txt (line 1)) (3.3.2)
Requirement already satisfied: idna<4,>=2.5 in /opt/homebrew/lib/python3.11/site-packages (from requests->-r requirements.txt (line 1)) (3.6)
Requirement already satisfied: urllib3<3,>=1.21.1 in /opt/homebrew/lib/python3.11/site-packages (from requests->-r requirements.txt (line 1)) (2.1.0)
Requirement already satisfied: certifi>=2017.4.17 in /opt/homebrew/lib/python3.11/site-packages (from requests->-r requirements.txt (line 1)) (2023.11.17)
WARNING: Skipping /opt/homebrew/lib/python3.11/site-packages/PyQt6-6.5.1.dist-info due to invalid metadata entry 'name'
WARNING: Skipping /opt/homebrew/lib/python3.11/site-packages/PyQt6-6.5.1.dist-info due to invalid metadata entry 'name'
➜  Log4jUnifi git:(main)
Drjacky commented 9 months ago

Maven was looking in the wrong repository.