EXexikyut·Dec 13, 2021
Whoever wants this gone is actively scrubbing it from GitHub (ie, it seems to be GitHub doing this). A few moments ago I found https://github.com/0x727/JNDIExploit, but while browsing around the repo suddenly went 404. Wow.
However, it seems that the way GitHub handles forks vs user deletions is that when a user deletes a fork (or it's Done For Them™), it seems that the fork "root owner" is transferred within the chain to someone else. I don't quite get it. Or maybe something else is going on.
In any case, a few minutes ago https://github.com/search?l=&q=filename%3AJNDIExploit.iml&ty... was showing JNDIExploit under "0x727", but now the page is showing the repo "owned" by a different user (with the network graph on the repo page showing everyone else as forking the repo from that new user).
So the above search link is your best bet to fin
Read the rest
ding the repo. It's currently listed as owned by "zzwlpx", but you'll probably see a different user (especially if https://github.com/zzwlpx/JNDIExploit no longer works).
It currently has 245 forks, so good luck, GitHub, keeping this squashed. [Edit: I now see a comment mentioning that GitHub has a policy of trying to squash 0days for the first X days, which is a very understandable reaction given that it's where everyone goes, from the skiddies who just like seeing things burn (and prevent everyone from having nice things, to the researchers trying to respectfully evaluate damage. Sigh.]
---
Some other things I found while playing with GitHub search:
https://github.com/zhuowei/GhidraLog4Shell
https://github.com/samjcs/log4shell-possible-malware
https://github.com/mbechler/marshalsec/