Solar, exploiting log4j

Prompts and answers

• What service is running on port 8983? (Just the name of the software)
  Apache Solr
• Take a close look at the first page visible when navigating to http://MACHINE_IP:8983. You should be able to see clear indicators that log4j is in use within the application for logging activity. What is the -Dsolr.log.dir argument set to, displayed on the front page?
  /var/solr/logs
• One file has a significant number of INFO entries showing repeated requests to one specific URL endpoint. Which file includes contains this repeated entry? (Just the filename itself, no path needed)
  solr.log
• What "path" or URL endpoint is indicated in these repeated entries?
  /admin/cores
• Viewing these log entries, what field name indicates some data entrypoint that you as a user could control? (Just the field name)
  params
• What is the output of running this command? (You should leave this terminal window open as it will be actively awaiting connections)
  Listening on 0.0.0.0:1389
• What user are you?
  solr
• What is the full path of the specific solr.in.sh file?
  /etc/default/solr.in.sh