https://worldofeuc.com logo
Join Slack
Powered by
# citrix-netscaler
  • t
  • m
    What is the over/under on a patch this weekend do we think?
  • m
    What if I just want to block all saml requests since we don’t use it. Responder policy?
    c
    • 2
    • 3
  • l
    I have my money on a patch tomorrow
  • s
    I'm currently blocking IPs at the NetScalers. Our networking team is also blocking them at the edge firewalls. are the gotham tech group mitigations effective or recommended? we've just opened a case with citrix
    d
    • 2
    • 1
  • c
    Okay for now. What works well when it comes to the SAML issue? There's so much discussion in this channel about this topic. 🙈
    n
    d
    +2
    • 5
    • 18
  • k
    Regardless of the Responder policy, we're seeing reboots, adding ACL to block the source IP 213.209.159.55
    🙌 1
    • 1
    • 1
  • s
    is citrix gateway as a service impacted?
    d
    d
    j
    • 4
    • 3
  • a
    To summarize what’s the best working solution?
    d
    c
    +5
    • 8
    • 10
  • m
    Has anyone seen any other indication then DoS ( restart ? ) so much wierd stuff being posted on other social media channels and security vendors spamming with their own IoC and trying to sell products that is rotting my brain.
    c
    d
    t
    • 4
    • 10
  • t
    did a HUGE clean up of my doom blogpost about the netscaler CVE poppelgaard.com/cve-2026-88771-through-cve-2026-88778-what-you-should-know-and-how-to-fix-your-netscaler-adc-netscaler-gateway#… you can now just click one thing you want to read about and move on... s orry for wasting peoples life doomscrolling.. i do better in future 😄
    👍 3
    🙏 1
  • t
    github updated with version 1.11 github.com/ThomasPoppelgaard/netscaler-ctx697096-checker release notes: github.com/ThomasPoppelgaard/netscaler-ctx697096-checker/…/1.11 #FEEDBACK appreaciated so we can win this 😉
  • c
    FYI: Seeing new injection attack from : 89.44.80.7 (HZ Hosting, Bulgaria) - 22, 031 failures since 5:38 UTC. See base64 chunks in the username field followed by fake pitboss crash messages.
  • m
    Against SAML vserver?
  • j
    seeing the same, have the find the IP
  • j
    @Charles Moore are your messages like this?
  • j
    image.png
  • c
    yes, against my SAML servers, since I posted that I did see that that IP is Thomas's github site's list.
  • j
    how do do I search for the source IP of that attack in splunk?
  • c
    Copy code
    not using splunk, but yes, thats an exact match: 
AAA LOGIN_FAILED ... User pitboss PPE unexpectedly died NSPPE;<command>;# X (the main one, 61,295 lines on 01-cvg since 2 October per the checker)
AAA Message ... "Authentication is rejected for pitboss PPE unexpectedly died NSPPE;<command>..."
AAATM Message ... "AAAD RESP: received resp, user: <pitboss PPE unexpectedly died NSPPE;<command>;# X>, factor: <aaavsrv_...>"
  • j
    image.png
  • j
    would that 46.151.182.18 be an ip from the attacker?
  • j
    definately looks like it...
  • c
    yes, thats the attackers IP
  • c
    I see the same IP
  • j
    132.243.166.140 is another one
    r
    • 2
    • 1
  • c
    same
  • c
    new responder policy that Citrix supplied applies to all vservers not just vservers using saml. fun, I guess because all endpoints have those url paths even if saml is not configured.
    e
    • 2
    • 1
  • j
    can you share it?
  • k
    just got update from v5c to v5d, I'm thinking of creating an expression that holds the stuff given by support when the version changes and then just have the same responder policy always bound on all relevant objects... then we can just do set expression command and use the same "samlshit" regardless of the environment, it would be easier to manage