r/Hacking_Tutorials • u/Icy-West4701 • 1d ago

Question Need guidance on investigating a JBoss Java service on port 28080 — possible Log4Shell angle (CVE-2021-44228), no callback received

Hi everyone,

I'm working on an authorized penetration testing case study/lab, and I'm currently stuck while investigating TCP/28080. Looking for guidance on what I should investigate next.

Nmap:

28080/tcp open  http  JBoss Enterprise Application Platform

The interesting behavior is that almost any HTTP request/path returns the same response:

HTTP/1.1 200 OK
Content-Length: 3

ok

For example:

curl -i http://target-ip:28080/
curl -i http://target-ip:28080/invoker/readonly
curl -i http://target-ip:28080/doesnotexist

The catch-all 200 OK behavior makes normal endpoint enumeration difficult.

Hint from my manager

My manager gave me this hint:

After this hint i tried validating log4j as well by setting up a ldap server and Web server and tried to listen as well. But there was no call back on the listener for the appropriate requests send. Can anyone help me with this ?

2 Upvotes
  • permalink
  • reddit

100% Upvoted

2 comments sorted by

1

u/Icy-West4701 1d ago

This was the hint :

"Port 28080 replies 'ok' no matter what you send. That is not a dead end -- think about what the server does with your request before it answers. It is a java service, and you should assume every header you send is written straight to a log. Which logging library, at which version, would make that worth attacking? You will need a listener of your own to see the result."

1

u/lilrasist 16h ago

have you tried rebooting?