This message was deleted.

There is a script developed by Citrix and FireEye that scans for common indicators of compromise. It should be linked in the blogs about the CVE.

i actually used a controlup script for it and we showed we were not vulnerable after the mitigation steps so not quite sure

If you want to test to see if it's vuln, then my friend made this public website which uses the trustedsec poc code: https://cve-2019-19781.azurewebsites.net/ The script mike mentions is here: https://github.com/citrix/ioc-scanner-CVE-2019-19781 I'm not sure if control is running the same script

awesome thank you! we'll check it out. we did get us to the latest 12.1 so SHOULD be good but cant hurt to check

As in HA setup? Pull the compromised one, build a new one and add it into HA again, it will inherit the config from the remaining NetScaler.

cool so we already pulled the compromised one and downloading a fresh appliance now. so once we set up the networking, etc and get it upgraded to the same maintenance level add to the HA and it will get all the config from primary? i know thats basically what you just said but just making sure i'm on the same page haha and is this safe during production or better off hours maybe?

To be honest, i would destroy both and redeploy them, since they are VPX it doesn't take very long to do, i would trust any of them. Remember to re-key the certificates, reset password on nsroot and other service accounts that was using the VPX. If they had shell access, you should do more forensic

yup that is something that we are considering too to be safe. we were able to narrow down what was actually hit so a start but still digging. i was mainly curious if theres a good way to export the config that we have to save time but you're right doesnt take that long to start from scratch

do a backup from the GUI/CLI, it will contain your ns.conf, ssl and licenses (Unless it's a new 13 your theme wont be backed up) I would restore it manually though, so look over the ns.conf, upload the new certificates (Make sure they are named the same as the old) give it the same MAC on the first NIC (So you can reuse the license)

cool thank you for all the help everyone! we'll probably go the route of setup a fresh one as standalone, cut over to it, build up the 2nd fresh and add to HA to get config from the newly built primary and be good sounds like as the safest route? (and rekey the certs like you said of course)

Sounds good to me (reset the password of service accounts/nsroot/other adc users)

keep in mind network config doesn’t sync over HA, so if you are doing more than 1 interface on your VPX with interface bindings, these will need to be rebuilt

yup that makes sense! thanks or everyones help here!

the backups should have the nsconf file in them, you could pull that out and use it

hmm thats interesting....what would we loose by doing that and need to make sure to resetup?

it’s everything but the networking and ssl certs pretty much

so if we'd strip that ns.conf file out of the backup from the old appliance and restore would that really save us much time vs just setting up from scratch?

depends on how many vservers you have

ahh gotcha. no we only have a few s

might not save much time then, but if you want them to be exactly the same could be worth doing

ive done more high level netscaler stuff so not sure how deep i want to get into this (i'm more the desktop admin end myself)

probably quicker to just rebuild int hat case

ya thats what i'm thinking. thank you for the help though!