From 0229c57e281cc9ce61ba082fe88552abee40cff1 Mon Sep 17 00:00:00 2001 From: Keuin Date: Fri, 10 Dec 2021 19:46:35 +0800 Subject: [PATCH 1/5] update log4j rce article: rearrange content, fix wrong reference --- _posts/2021-12-10-log4j2-rce.md | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/_posts/2021-12-10-log4j2-rce.md b/_posts/2021-12-10-log4j2-rce.md index 5edf6d9..5091973 100644 --- a/_posts/2021-12-10-log4j2-rce.md +++ b/_posts/2021-12-10-log4j2-rce.md @@ -9,31 +9,34 @@ categories: security 注意：此版本范围的 Minecraft 使用的 log4j2 版本过低（2.8.1），不支持`formatMsgNoLookups`开关。因此，**添加JVM启动参数**或者**添加系统环境变量**、**使用最新的 Fabric Loader** 的修补方法**无效**。请使用下文介绍的修补措施。 -## 1.1 适用于 Minecraft 1.7.x ~ 1.16.5 服务端的修补措施 +## 1.1 适用于 Minecraft 1.7.x ~ 1.16.5 客户端的修补措施 -有两种修补策略可供选用： +由于 Minecraft 启动器在启动 Minecraft 前会校验资源文件的完整性，因此不能使用 *log4j-jndi-finder* 直接对 log4j 的二进制文件进行修改。 -1. 使用`1.1`节内介绍的措施进行修补。如果您确定没有第三方 MOD 内置了低版本的 log4j ，那么您可以使用此方法安全修补。（如没有任何 MOD 加载器的原版服务端） -2. 使用 [log4j-jndi-finder](https://github.com/keuin/log4j-jndi-finder) 搜索并移除所有`JndiLookup`类。该脚本将遍历 Minecraft 服务端目录下的所有`.jar`文件的内容，查找并移除`JndiLookup.java`文件。由于 Minecraft 从不使用 JNDI 或 LDAP，这样做完全不会影响 Minecraft 的正常工作。 +1. 可以使用 [log4j-patch](https://github.com/Glavo/log4j-patch) 对 Minecraft 客户端进行非侵入式修补。 + 该补丁作为 *javaagent* 随 Minecraft 加载，将旧版本的 log4j 中存在漏洞的`JndiLookup`替换为一个空实现。 + 由于 Minecraft 从不使用 JNDI 或 LDAP，这样做完全不会影响 Minecraft 的正常工作。 +2. 更新 log4j。官方启动器、HMCL、MultiMC、BakaXL、PCL2等启动器均已采取措施，但本文仅检查了 MultiMC，该启动器现在会在运行时将 log4j 版本更新至 2.15.0，这个版本是安全的。 + 如果您不确定，可以自行查看资源列表，以确定 log4j 版本，或者同时使用方法 1 进行非侵入式修补。 -## 1.2 适用于 Minecraft 1.7.x ~ 1.16.5 客户端的修补措施 +## 1.2 适用于 Minecraft 1.7.x ~ 1.16.5 服务端的修补措施 -由于 Minecraft 启动器在启动 Minecraft 前会校验资源文件的完整性，因此不能使用 *log4j-jndi-finder* 直接对 log4j 的二进制文件进行修改。 +有两种修补策略可供选用： + +1. 使用`1.1`节介绍的 [log4j-patch](https://github.com/Glavo/log4j-patch) 进行修补。如果您确定没有第三方 MOD 内置了低版本的 log4j ，那么您可以使用此方法安全修补。（例如：没有任何 MOD 加载器的原版服务端） +2. 使用 [log4j-jndi-finder](https://github.com/keuin/log4j-jndi-finder) 搜索并移除所有`JndiLookup`类。该脚本将遍历 Minecraft 服务端目录下的所有`.jar`文件的内容，查找并移除`JndiLookup.java`文件。由于 Minecraft 从不使用 JNDI 或 LDAP，这样做完全不会影响 Minecraft 的正常工作。 -可以使用 [log4j-patch](https://github.com/Glavo/log4j-patch) 对Minecraft客户端进行非侵入式修补。 -该补丁作为 *javaagent* 随 Minecraft 加载，将旧版本的 log4j 中存在漏洞的`JndiLookup`替换为一个空实现。 -由于 Minecraft 从不使用 JNDI 或 LDAP，这样做完全不会影响 Minecraft 的正常工作。 -# 2. Minecraft 1.17.x 或更新 +# 2. Minecraft 1.17.x 或更新的版本 此版本范围的 Minecraft 使用了较新的 log4j（2.14.1），因此可以通过设置`formatMsgNoLookups`开关进行修补。 -## 2.1 适用于 Minecraft 1.17.x 或更新的服务端的修补措施 +## 2.1 适用于 Minecraft 1.17.x 或更新的客户端的修补措施 1. 添加JVM启动参数`-Dlog4j2.formatMsgNoLookups=true`。 2. 将环境变量`FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS`设置为`true`。 -## 2.2 适用于 Minecraft 1.17.x 或更新的客户端的修补措施 +## 2.2 适用于 Minecraft 1.17.x 或更新的服务端的修补措施 参考`2.1`节介绍的措施进行修补。 From 2b8fe03aa51ce04ef232e39fa7f01af811e7b3ff Mon Sep 17 00:00:00 2001 From: Keuin Date: Mon, 13 Dec 2021 16:57:59 +0800 Subject: [PATCH 2/5] Update project list. --- projects.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/projects.md b/projects.md index 168664f..958fd87 100644 --- a/projects.md +++ b/projects.md @@ -14,5 +14,8 @@ Projects maintained by *HITMC*: - [RconJobs](https://github.com/hit-mc/RconJobs) - [OhMyVanillaMinecraft](https://github.com/hit-mc/OhMyVanillaMinecraft) - [FastJoin](https://github.com/hit-mc/fastjoin) + - [doublewhite](https://github.com/hit-mc/doublewhite) + - [onesmp-waypoint-clustering](https://github.com/hit-mc/onesmp-waypoint-clustering) + - [Blame-Fabric](https://github.com/hit-mc/Blame-Fabric) Feel free to open issues or make pull-requests... and join us! If you like. From 6a924303338564cbca5b89c04be6f7f8435ffd34 Mon Sep 17 00:00:00 2001 From: Keuin Date: Sun, 6 Mar 2022 14:42:46 +0800 Subject: [PATCH 3/5] Set page order in `_cofig.yml`. Add `Hack with HITMC` in about page and rename it. Add code conduct and management documentation. Move from `hitmc.onesmp.org` to `hit-mc.github.io`. --- _config.yml | 7 ++++++- about.md | 10 ---------- hack_with_hitmc.md | 34 ++++++++++++++++++++++++++++++++++ projects.md | 1 - 4 files changed, 40 insertions(+), 12 deletions(-) delete mode 100644 about.md create mode 100644 hack_with_hitmc.md diff --git a/_config.yml b/_config.yml index 09c8fcd..46f2cf4 100644 --- a/_config.yml +++ b/_config.yml @@ -18,7 +18,7 @@ email: hitmc-project@protonmail.com description: >- # this means to ignore newlines until "baseurl:" We do Minecraft things, for ourselves, and for the Minecraft community. baseurl: "" # the subpath of your site, e.g. /blog -url: "https://hitmc.onesmp.org" # the base hostname & protocol for your site, e.g. http://example.com +url: "https://hit-mc.github.io" # the base hostname & protocol for your site, e.g. http://example.com github_username: hit-mc # Build settings @@ -27,6 +27,11 @@ theme: minima plugins: - jekyll-feed +# Page orders in headbar +header_pages: + - projects.md + - hack_with_hitmc.md + # Exclude from processing. # The following items will not be processed, by default. Create a custom list # to override the default setting. diff --git a/about.md b/about.md deleted file mode 100644 index 85fc4dd..0000000 --- a/about.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -layout: page -title: About -permalink: /about/ -order: 1 ---- - -*HITMC Project* is a group of people who loves open-source and Minecraft. -It originates from *OneSMP (一个纯净生存服)* in *Harbin Institute of Technology*. -However, we welcome everyone who loves Minecraft and contributes to open-source Minecraft-related code. diff --git a/hack_with_hitmc.md b/hack_with_hitmc.md new file mode 100644 index 0000000..76f5180 --- /dev/null +++ b/hack_with_hitmc.md @@ -0,0 +1,34 @@ +--- +layout: page +title: Hack with HITMC +permalink: /about/ +--- + +*HITMC Project* is a group of people who loves open-source and Minecraft. +It originates from *OneSMP (一个纯净生存服)* in *Harbin Institute of Technology*. +However, we welcome everyone who loves Minecraft and contributes to open-source Minecraft-related code. + + +# How to join HITMC + +Though *HITMC Project* originates from *OneSMP* in 2020, it's not an organization owned by *OneSMP* nowadays, but a group of Minecraft lovers (mostly) in HIT. +If you wish to hack with HITMC and do open-source stuff for Minecraft, then you may start from: + +1. Start using projects created by HITMC. +2. Submit issues for existing repo in HITMC, describing what problem you've encountered or what should be improved. +3. Submit pull requests for existing repo in HITMC, and accept the inspection from the repo's owner. +4. Create a original or forked repo in HITMC, and keep improving it. + + +# How we manage ourselves + +In HITMC, there are owners and members. Owners are those people who own at least one repo belong to HITMC. + +When we talk about a person has *owned* a repo, we mean: + +- This repo is originally created by himself or forked by himself. +- He keeps track of issues and PRs of the repo he owned: + + He reviews code contributions from other people, and decide how to merge it into the mainstream. + + He manages issues created by others, and decide how to handle them. + +Especially, the repository `hit-mc.github.io` is owned by all members in our organization. No one can directly push to its main branch. All pull requests should be reviewed and accepted by everyone. diff --git a/projects.md b/projects.md index 958fd87..c84b182 100644 --- a/projects.md +++ b/projects.md @@ -2,7 +2,6 @@ layout: page title: Projects permalink: /projects/ -order: 2 --- Projects maintained by *HITMC*: From 899490bbfa6c1a9e4bc0e2029ab1c9bbfa4d4e70 Mon Sep 17 00:00:00 2001 From: Keuin Date: Sun, 6 Mar 2022 17:38:52 +0800 Subject: [PATCH 4/5] Rename: hack_with_hitmc -> about --- hack_with_hitmc.md => about.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename hack_with_hitmc.md => about.md (100%) diff --git a/hack_with_hitmc.md b/about.md similarity index 100% rename from hack_with_hitmc.md rename to about.md From c13d51313abb25ee356793413117fe1f212888d5 Mon Sep 17 00:00:00 2001 From: Keuin Date: Sun, 6 Mar 2022 17:40:38 +0800 Subject: [PATCH 5/5] Recongigure: hack_with_hitmc -> about --- _config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/_config.yml b/_config.yml index 46f2cf4..e87075f 100644 --- a/_config.yml +++ b/_config.yml @@ -30,7 +30,7 @@ plugins: # Page orders in headbar header_pages: - projects.md - - hack_with_hitmc.md + - about.md # Exclude from processing. # The following items will not be processed, by default. Create a custom list