diff --git a/_config.yml b/_config.yml index 09c8fcd..e87075f 100644 --- a/_config.yml +++ b/_config.yml @@ -18,7 +18,7 @@ email: hitmc-project@protonmail.com description: >- # this means to ignore newlines until "baseurl:" We do Minecraft things, for ourselves, and for the Minecraft community. baseurl: "" # the subpath of your site, e.g. /blog -url: "https://hitmc.onesmp.org" # the base hostname & protocol for your site, e.g. http://example.com +url: "https://hit-mc.github.io" # the base hostname & protocol for your site, e.g. http://example.com github_username: hit-mc # Build settings @@ -27,6 +27,11 @@ theme: minima plugins: - jekyll-feed +# Page orders in headbar +header_pages: + - projects.md + - about.md + # Exclude from processing. # The following items will not be processed, by default. Create a custom list # to override the default setting. diff --git a/_posts/2021-12-10-log4j2-rce.md b/_posts/2021-12-10-log4j2-rce.md index 5edf6d9..5091973 100644 --- a/_posts/2021-12-10-log4j2-rce.md +++ b/_posts/2021-12-10-log4j2-rce.md @@ -9,31 +9,34 @@ categories: security 注意:此版本范围的 Minecraft 使用的 log4j2 版本过低(2.8.1),不支持`formatMsgNoLookups`开关。因此,**添加JVM启动参数**或者**添加系统环境变量**、**使用最新的 Fabric Loader** 的修补方法**无效**。请使用下文介绍的修补措施。 -## 1.1 适用于 Minecraft 1.7.x ~ 1.16.5 服务端的修补措施 +## 1.1 适用于 Minecraft 1.7.x ~ 1.16.5 客户端的修补措施 -有两种修补策略可供选用: +由于 Minecraft 启动器在启动 Minecraft 前会校验资源文件的完整性,因此不能使用 *log4j-jndi-finder* 直接对 log4j 的二进制文件进行修改。 -1. 使用`1.1`节内介绍的措施进行修补。如果您确定没有第三方 MOD 内置了低版本的 log4j ,那么您可以使用此方法安全修补。(如没有任何 MOD 加载器的原版服务端) -2. 使用 [log4j-jndi-finder](https://github.com/keuin/log4j-jndi-finder) 搜索并移除所有`JndiLookup`类。该脚本将遍历 Minecraft 服务端目录下的所有`.jar`文件的内容,查找并移除`JndiLookup.java`文件。由于 Minecraft 从不使用 JNDI 或 LDAP,这样做完全不会影响 Minecraft 的正常工作。 +1. 可以使用 [log4j-patch](https://github.com/Glavo/log4j-patch) 对 Minecraft 客户端进行非侵入式修补。 + 该补丁作为 *javaagent* 随 Minecraft 加载,将旧版本的 log4j 中存在漏洞的`JndiLookup`替换为一个空实现。 + 由于 Minecraft 从不使用 JNDI 或 LDAP,这样做完全不会影响 Minecraft 的正常工作。 +2. 更新 log4j。官方启动器、HMCL、MultiMC、BakaXL、PCL2等启动器均已采取措施,但本文仅检查了 MultiMC,该启动器现在会在运行时将 log4j 版本更新至 2.15.0,这个版本是安全的。 + 如果您不确定,可以自行查看资源列表,以确定 log4j 版本,或者同时使用方法 1 进行非侵入式修补。 -## 1.2 适用于 Minecraft 1.7.x ~ 1.16.5 客户端的修补措施 +## 1.2 适用于 Minecraft 1.7.x ~ 1.16.5 服务端的修补措施 -由于 Minecraft 启动器在启动 Minecraft 前会校验资源文件的完整性,因此不能使用 *log4j-jndi-finder* 直接对 log4j 的二进制文件进行修改。 +有两种修补策略可供选用: + +1. 使用`1.1`节介绍的 [log4j-patch](https://github.com/Glavo/log4j-patch) 进行修补。如果您确定没有第三方 MOD 内置了低版本的 log4j ,那么您可以使用此方法安全修补。(例如:没有任何 MOD 加载器的原版服务端) +2. 使用 [log4j-jndi-finder](https://github.com/keuin/log4j-jndi-finder) 搜索并移除所有`JndiLookup`类。该脚本将遍历 Minecraft 服务端目录下的所有`.jar`文件的内容,查找并移除`JndiLookup.java`文件。由于 Minecraft 从不使用 JNDI 或 LDAP,这样做完全不会影响 Minecraft 的正常工作。 -可以使用 [log4j-patch](https://github.com/Glavo/log4j-patch) 对Minecraft客户端进行非侵入式修补。 -该补丁作为 *javaagent* 随 Minecraft 加载,将旧版本的 log4j 中存在漏洞的`JndiLookup`替换为一个空实现。 -由于 Minecraft 从不使用 JNDI 或 LDAP,这样做完全不会影响 Minecraft 的正常工作。 -# 2. Minecraft 1.17.x 或更新 +# 2. Minecraft 1.17.x 或更新的版本 此版本范围的 Minecraft 使用了较新的 log4j(2.14.1),因此可以通过设置`formatMsgNoLookups`开关进行修补。 -## 2.1 适用于 Minecraft 1.17.x 或更新的服务端的修补措施 +## 2.1 适用于 Minecraft 1.17.x 或更新的客户端的修补措施 1. 添加JVM启动参数`-Dlog4j2.formatMsgNoLookups=true`。 2. 将环境变量`FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS`设置为`true`。 -## 2.2 适用于 Minecraft 1.17.x 或更新的客户端的修补措施 +## 2.2 适用于 Minecraft 1.17.x 或更新的服务端的修补措施 参考`2.1`节介绍的措施进行修补。 diff --git a/about.md b/about.md index 85fc4dd..76f5180 100644 --- a/about.md +++ b/about.md @@ -1,10 +1,34 @@ --- layout: page -title: About +title: Hack with HITMC permalink: /about/ -order: 1 --- *HITMC Project* is a group of people who loves open-source and Minecraft. It originates from *OneSMP (一个纯净生存服)* in *Harbin Institute of Technology*. However, we welcome everyone who loves Minecraft and contributes to open-source Minecraft-related code. + + +# How to join HITMC + +Though *HITMC Project* originates from *OneSMP* in 2020, it's not an organization owned by *OneSMP* nowadays, but a group of Minecraft lovers (mostly) in HIT. +If you wish to hack with HITMC and do open-source stuff for Minecraft, then you may start from: + +1. Start using projects created by HITMC. +2. Submit issues for existing repo in HITMC, describing what problem you've encountered or what should be improved. +3. Submit pull requests for existing repo in HITMC, and accept the inspection from the repo's owner. +4. Create a original or forked repo in HITMC, and keep improving it. + + +# How we manage ourselves + +In HITMC, there are owners and members. Owners are those people who own at least one repo belong to HITMC. + +When we talk about a person has *owned* a repo, we mean: + +- This repo is originally created by himself or forked by himself. +- He keeps track of issues and PRs of the repo he owned: + + He reviews code contributions from other people, and decide how to merge it into the mainstream. + + He manages issues created by others, and decide how to handle them. + +Especially, the repository `hit-mc.github.io` is owned by all members in our organization. No one can directly push to its main branch. All pull requests should be reviewed and accepted by everyone. diff --git a/projects.md b/projects.md index 168664f..c84b182 100644 --- a/projects.md +++ b/projects.md @@ -2,7 +2,6 @@ layout: page title: Projects permalink: /projects/ -order: 2 --- Projects maintained by *HITMC*: @@ -14,5 +13,8 @@ Projects maintained by *HITMC*: - [RconJobs](https://github.com/hit-mc/RconJobs) - [OhMyVanillaMinecraft](https://github.com/hit-mc/OhMyVanillaMinecraft) - [FastJoin](https://github.com/hit-mc/fastjoin) + - [doublewhite](https://github.com/hit-mc/doublewhite) + - [onesmp-waypoint-clustering](https://github.com/hit-mc/onesmp-waypoint-clustering) + - [Blame-Fabric](https://github.com/hit-mc/Blame-Fabric) Feel free to open issues or make pull-requests... and join us! If you like.