Minecraft Beaten in 0:00.050 Using Log4j Exploit

Wowww dreammm

This is literally the closest thing to Arbitrary code exec a "modern" video game will ever have. Best use of the exploit i could have ever imagined too 😂

lmao

dream was quiet since this dropped

Xd Java issues

cool

Nice!

Wait what

shiiit i gotta bring this up in our hackspace and see which crazy one will get the best times lmao

Minecraft cheat developers discovering a god tier remote code execution exploit that affects like 90% of the fortune 100 companies only to use it to dox people on 2b2t:

Slowest femboy speedrun

this adventure was awesome,

minecraft credits warp any%

Tool name?

what even happened?

this is what speedrunner want

submit it to speedrun

This thing? aHR0cHM6Ly93d3cuc3BlZWRydW4uY29tL2ZpbmRzZWVkP2g9QUNFLVNldF9TZWVkX0dsaXRjaGxlc3NfU3RydWN0dXJlcyZ4PWxfZ2RyMHA4a2QtemRubG1ycTI (base64 URI

speedrunning has devoled into hacking.... what an achievement bro

log4j is actually my minecraft nick, wtf

Actually, speedruns only count as soon as you hit the first key once you load in. Since you've probably touched 0 keys on your keyboard, you beat minecraft instantly

50ms is exactly one tick

people who just joined be like

I like how he managed to gather the ender perls

HOLY SHIT
ABSOLUTE WORLD RECORD!!!!

BIG CONGRATULATIONS BROTHER!!!!!!!!

ez game

What VSCode theme and font do you use?

beat that, dream

I just finished hunter hunter and now I read neferupitou on your terminal 0_0 (she's one of my favorites when talking about character design)

welp, games solved
ggs

legit speedrun

Imagine having a computer so slow that after waiting for the loading terrain to finish, the dirt background starts scrolling and shows the credits lol.

Gg

hmmmmmm its work on 1.8.9 version? or it fix also for 1.8.9?

GG on the Speedrun World Record!

Siiiiiiiick :D

Minecraft WR TAS any%

u can actually beat the game in time like this without glitches/exploits etc.

sub .50 when?

XD thanks for the code.

How can i set this up?

the classic CVE-2022-2325

This... made me realize just how utterly bananas Log4Shell is. I didn't start a proper cybersecurity education until 2022, and I hadn't known that it had a CVSS score of 10.

I set the world name to be a Log4shell payload. Then, I remove focus from the Minecraft window so that it pauses immediately. When Minecraft pauses it saves the world. Here's where the exploit comes in. When Minecraft saves the world it logs it into the console. This will run my payload as a URL, download my L.class file, and then run the code inside with full access to Minecraft's internals.