The Java Agent: Modifying Bytecode at Runtime to Protect Against Log4J
summary
Shows how the Java Agent API is used to attach both dynamic attach and static agent to a running JVM, enumerate classes (JBOM), and perform runtime bytecode patching with ASM bytecode rewrite. Demonstrates loading an agent jar, intercepting javax.naming/Lookup, replacing the lookup method to return null, and stopping a Log4Shell payload (demoed by preventing the calculator spawn). Provides working demos and repos (jbom and a cornflakerizer-rasp RASP); both attach modes and the bytecode patch successfully block the exploit.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:35java.langinstrumentation
- 2:21Dynamically attaching
- 8:14JBOM Demo
- 21:21Static attaching
- 21:46RASPs
- 22:29Log4J interpolation
- 23:58What is JNDI
- 24:54What a malicious JNDI server can do
- 29:10Patching Log4J at runtime
- 30:00Vulnerability Demo
- 38:12Links
- 38:43Outro
