This message was deleted.

Example of the directories:

Hey, The stuff against /etc/passwd is a tough one i feel, because if you ran the tool before there will already be false positives. it comes from this in the scanner: shell_history_blacklist[9]=“/etc/passwd” Now if you know the default users in the passwd, i would compare it.. on firmware before 12.1.x it’s 8 if i recall right and 24 in newer p.s did see your second post, those look like the default XML files trying to read info on the NS

there's no bash command history or new files or anything like that, just detection of a directory traversal attempt

If it’s from the notice, can you see if it ens with a 404?

"when you ran the tool there will be false positives" I assume you're talking about the forensic tool from Citrix?

yes

I can run the script back to back and it doesn't flag new entries for directory traversal

Okay, but like i wrote i wrote my msg before i saw your second post. I thought you saw entries like this: ///var/log/notice.log:Jan 28 113521 <local7.notice> ns bash[48657]: (null) on /dev/pts/0 shell_command=“local entries=$(zgrep -F “$re” “$root_directory/$path”* /dev/null); if [ -n “$entries” ]; then found=true; report_match “blacklisted content ‘$re’“; report “matches for ‘$re’:“; report “$entries”; report “Please review the above shell history entries for unexpected activity.“; report “They match signatures commonly associated with post-exploitation;“; report “however, this may overlap with legitimate system administration.“; report “If you recognize the commands as something you typed, then you can probably ignore them.“; report “For example, reviewing ‘/etc/passwd’ to manage users may be valid in your environment.“; fi”

alot of them dont even have /vpn/in the path, just random dirs tied to old exploits

Yeah, that looks like something that isn’t related to the new CVE

I figured as much, I guess that any directory traversal attempt that includes the /etc/passwd in the path is going to be flagged by the tool due to its presence in the log file

Yeah i would assume so, since the scanner just scans this: shell_history_paths[0]=“/var/log/bash.log”; shell_history_paths[1]=“/var/log/notice.log”; shell_history_paths[2]=“/var/log/sh.log”; So anything in them that contains /etc/passwd will be flagged https://github.com/citrix/ioc-scanner-CVE-2019-19781/blob/master/scanners/shell-history.sh

We see a lot of that stuff from our Qualys scanner Neil

Thanks...qualys and Nessus both scan this thing depending which direction it’s facing, I was trying to correlate the time to when the scans ran but thats handles by someone else and haven’t fully been able to yet

yea, this is normal stuff really