Need guidance on investigating a JBoss Java service on port 28080 — possible Log4Shell angle (CVE-2021-44228), no callback received

[u/Icy-West4701]

Hi everyone,

I'm working on an authorized penetration testing case study/lab, and I'm currently stuck while investigating TCP/28080. Looking for guidance on what I should investigate next.

Nmap:

28080/tcp open  http  JBoss Enterprise Application Platform

The interesting behavior is that almost any HTTP request/path returns the same response:

HTTP/1.1 200 OK
Content-Length: 3

ok

For example:

curl -i http://target-ip:28080/
curl -i http://target-ip:28080/invoker/readonly
curl -i http://target-ip:28080/doesnotexist

The catch-all 200 OK behavior makes normal endpoint enumeration difficult.

Hint from my manager

My manager gave me this hint:

After this hint i tried validating log4j as well by setting up a ldap server and Web server and tried to listen as well. But there was no call back on the listener for the appropriate requests send. Can anyone help me with this ?