Custom Metasploit Module for Log4Shell Scanner

Madhav Bhatt
4 min readDec 21, 2021

In this article, we will discuss a customized Metasploit module I wrote for scanning applications vulnerable to Log4Shell as well as how you can further customize it to suit your needs.

There is already an existing scanner available for this which you can find on metasploit-framework GitHub.

You may ask why did I write a customized module despite the one that is available ? For starters, it’s a lot of fun. Also, I was already half-way writing the custom module before I found the available one. I figured I might as well keep the part of the code that works best for me.

Loading The Module

It is very easy to load custom modules in metasploit as shown in the steps below. You can follow steps in this article to get better understanding of it.

The code for customized_log4jshell_scanner.rb can be found here.

root@kali# mkdir -p /root/.msf4/modules/auxiliary/scanner/log4j/root@kali# cp <custom-log4jshell-scanner-path>  /root/.msf4/modules/auxiliary/scanner/log4j/customized_log4jshell_scanner.rbroot@kali# msfconsolemetasploit-shell > use auxiliary/scanner/log4j/customized_log4jshell_scanner

Setting The Module Options

The module has multiple options. We will discuss the ones that are most likely to be used.


This is the IP you want the LDAP callback for. It will be used in payload. This option was added to supplement the situation where external IP would be different from host IP ( i.e. AWS ).

It doesn’t have to be external IP though. ( I know …. could have named this parameter better ) You can even use the internal IP of attacker box as long as the victim can connect to that IP.




How long metasploit will listen for callback


You may encounter situation where you have to supply all the parameters in the request to successfully exploit the RCE. This option allows you to specify multiple parameters and it will send the payload in the first specified parameter.


Target Host(s) and Port. Obviously, you can set multiple RHOSTS to scan at scale.


This is the IP and Port to which metasploit server will bind the listener. ( Not to confuse SRVHOST with ExternalIP option which is what will be sent in the payload )

You may have to choose different SRVPORT ( or exit metasploit ) every time you run the scanner. Will fix this as I improve this module. The trick is to use save command to reduce the annoyance.


The URI you want to send the HTTP(S) request to.

Proof Of Concept (POC)

There is POC exploit code available on exploit-db if you want to better understand this vulnerability. You would still need a vulnerable application which you can find here.

The screenshots below shows the custom module scanning the vulnerable application as well as doing a mass scan of other IPs which may or may not have a web server running.

Scanning Vulnerable Application
Scanning Targets at Scale

Customizing The Module

You may end up writing your own module to meet your needs because this is a fairly new vulnerability and all the plugin modules for different scanners out there are still work in progress.

Here are some things you can do to customize this code.

Adding More HTTP Methods

This module uses send_request_cgi which is in built function in metasploit. For now, I have only allowed to send GET and POST requests.However, You can choose a different function to use as well as add more HTTP METHODS on top of this. You can find more information here.

You can also add better parameter handling to make requests look more realistic. i.e. if one of the variables in the form you are posting is phone-number, it populates it with random 10 digit number along with payload in one of the other variables.

Saving the Output

This functionality will be added as I improve this module but simply adding ruby commands of writing output to disk can do the trick.

Getting that Shell

This module uses RCE to scan if the application is vulnerable or not. If you are a ruby ninja, you can take this further to get a reverse shell.

Additional Resources

If you are looking for additional information on how to write a custom metasploit module, check out these resources :

In Conclusion

We discussed how we can use custom module to scan for Log4Shell as well as customize it to meet our needs. Leveraging MetaSploit’s APIs and resources mentioned above can make it fairly easy to write custom plugins when the next Log4Shell comes out.


I would like to thank zeroSteiner whose metasploit module is already merged in the master branch. Without going through some of that LDAP request handling code , it would have taken me longer to write this module.



Madhav Bhatt

Effective collaboration between red and blue can produce offensive defense a.k.a blue team quickly detecting, responding and disrupting attackers activities.