4 ms·
Whoever wants this gone is actively scrubbing it from GitHub (ie, it seems to be GitHub doing this). A few moments ago I found https://github.com/0x727/JNDIExpl
by exikyut 5y ago
Whoever wants this gone is actively scrubbing it from GitHub (ie, it seems to be GitHub doing this). A few moments ago I found https://github.com/0x727/JNDIExploit https://github.com/0x727/JNDIExploit, but while browsing around the repo suddenly went 404. Wow.
However, it seems that the way GitHub handles forks vs user deletions is that when a user deletes a fork (or it's Done For Them™), it seems that the fork "root owner" is transferred within the chain to someone else. I don't quite get it. Or maybe something else is going on.
In any case, a few minutes ago https://github.com/search?l=&q=filename%3AJNDIExploit.iml&type=code https://github.com/search?l=&q=filename%3AJNDIExploit.iml&ty... was showing JNDIExploit under "0x727", but now the page is showing the repo "owned" by a different user (with the network graph on the repo page showing everyone else as forking the repo from that new user).
So the above search link is your best bet to finding the repo. It's currently listed as owned by "zzwlpx", but you'll probably see a different user (especially if https://github.com/zzwlpx/JNDIExploit https://github.com/zzwlpx/JNDIExploit no longer works).
It currently has 245 forks, so good luck, GitHub, keeping this squashed. [Edit: I now see a comment mentioning that GitHub has a policy of trying to squash 0days for the first X days, which is a very understandable reaction given that it's where everyone goes, from the skiddies who just like seeing things burn (and prevent everyone from having nice things, to the researchers trying to respectfully evaluate damage. Sigh.]
---
Some other things I found while playing with GitHub search:
https://github.com/zhuowei/GhidraLog4Shell https://github.com/zhuowei/GhidraLog4Shell
https://github.com/samjcs/log4shell-possible-malware https://github.com/samjcs/log4shell-possible-malware
https://github.com/mbechler/marshalsec/ https://github.com/mbechler/marshalsec/
- christophetd 5y agoThat's useful, thanks for sharing! Based on this, it seems extremely likely that GitHub has taken down JNDIExploit, as opposed to its owner removing it themselves. (See the question raised in https://news.ycombinator.com/item?id=29537822 https://news.ycombinator.com/item?id=29537822)