World of EUC

It depends when you last did an upgrade, (before patching for the CVE)

I understand that the command should be ran before patching for the CVE, and that the date should be ran before the CVE, but my question is for post-patching. I believe that a patched device should have a mess of files stamped Jul 10th based on the BUILD date of the patch.   I'm looking for someone who has already patched,  to see if they can corollate that observation, or rule it out.

I’ve got all my timestamps on July 19 22:39 when I did one of the upgrades

So the command only makes sense pre-upgrade

which makes sense because these are all overwritten

2 questions, both post-upgrade: Are you running 13.1? Are you seeing ANY Jul 10th stamps?

we have a 13.1 somewhere as well, should check which one

also: Did you run `find /netscaler/ns_gui/ -type f -name *.php -newermt 20230709 -exec ls -l {} \;`  or a variant with `20230719` ?

The ns_gui timestamps changed at every reboot. U list ein the scripts before update and u must know for the ns_gui command the reboot time. I change this in my blog article. 

Part of that path is indeed overwritten at reboot. Not sure (by heart) if the full path is extracted again.

I'm not sure this is reboot related behavior. What I do notice is that if you pop open the firmware upgrade package, there's a number of files that show those same time ranges on their stamps.

small assortment of examples: ``` -r--r--r--  1 500  513  75555 Jul 10 11:32 /netscaler/ns_gui/admin_ui/nitro/nitro.php -r--r--r--  1 500  513  3208 Jul 10 11:32 /netscaler/ns_gui/admin_ui/php/application/config/autoload.php -r--r--r--  1 500  513  13851 Jul 10 11:32 /netscaler/ns_gui/admin_ui/php/application/config/config.php -r--r--r--  1 500  513  1598 Jul 10 11:32 /netscaler/ns_gui/admin_ui/php/application/config/constants.php -r--r--r--  1 500  513  3221 Jul 10 11:32 /netscaler/ns_gui/admin_ui/php/application/config/database.php -r--r--r--  1 500  513  1152 Jul 10 11:32 /netscaler/ns_gui/admin_ui/php/application/config/doctypes.php ```

Well, if there was no reboot around that timestamp and you didn’t perform an upgrade, it looks suspicious

so it depends what the contents of those files is

is there a copy of the IOC anywhere, or do we still need to call support for it?