Solar, exploiting log4j

Walkthrough summary

Solar, exploiting log4j TryHackMe walkthrough with 8 answered prompts and lab methodology notes.

Sample prompts covered

• What service is running on port 8983? (Just the name of the software)
  Open the walkthrough page to inspect the full answer and command flow.
• Take a close look at the first page visible when navigating to http://MACHINE_IP:8983. You should be able to see clear indicators that log4j is in use within the application for logging activity. What is the -Dsolr.log.dir argument set to, displayed on the front page?
  Open the walkthrough page to inspect the full answer and command flow.
• One file has a significant number of INFO entries showing repeated requests to one specific URL endpoint. Which file includes contains this repeated entry? (Just the filename itself, no path needed)
  Open the walkthrough page to inspect the full answer and command flow.
• What "path" or URL endpoint is indicated in these repeated entries?
  Open the walkthrough page to inspect the full answer and command flow.
• Viewing these log entries, what field name indicates some data entrypoint that you as a user could control? (Just the field name)
  Open the walkthrough page to inspect the full answer and command flow.