Understanding the Log4j Vulnerability | Exploiting VMware VCenter & a reverse shell🔥| Patch NOW!

[melusimgwenya]

straight to the point, other videos spend 30 minutes talking about nothing. Excellent video!!!!

[luma]

Very well explained. I would liked if you showed the behavior after applying the fix but still, thanks for sharing. Great quality content

[QuincyNtuli]

Awesome presentation, I think I like this method better. There is a room on THM where you manually had to compile the reverse shell into java then the exploit fetches the compiled reverse shell. This method though is more elegant, thank you very much.

[jytan]

vcenter is one of the most impacted products

[manan_sanghvi]

can you please tell me, it is only vulnerable to specific version? or any version without pacthed is vulnerable??

[reyanthonyflores]

Please help, I tried using the Windows Server and installed the vCenter Server (not Appliances version) on it. But I can't get it to work maybe the payload is the problem?

[tjwreds]

ok, dumb guy question. Why the hell would vcenter try to contact an ldap server it's not already configured to contact? Seems this exploit goes away with that fixed, or is that required for something?

[vernturnquist]

I don’t see any patch offered on vcenter appliance offered yet! :(

[hidayatbachtar]

is that flow similiar with log poisoning php?

[LiveStarful]

Hi, would it be the same for the windows version of vcenter?

[NexInfernis]

in --hostname " " my machine ip will be used If I am not wrong

[lauriusndipwashimwe]

how did you install Java v1.7+ and Maven v3+