@Maurice_Sec
Joined July 2021
  • Tweets4
  • Following32
  • Followers51
1Media
1/4 NetScaler exploitation IOCs (CVE-2026-88771 suspected) 🚨 Sharing detection info from a failed exploitation attempt seen on 22 Sep. Unauthenticated, two-stage, fully automated. Shared for detection only, so you can check your own logs. #NetScaler #Citrix #DFIR
6
32
1
127
13,073
4/4 The payload drops a PHP webshell at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver served as a fake .css, and sets /bin/sh to 6555.
1
2
17
1,862
3/4 Trigger A VPN login with a command injection as the username. It greps the access log for "AA:", decodes the payload and pipes it to sh.
1
12
1,848
2/4 Staging The attacker sends a request with a Base64 payload in the User-Agent, prefixed with "AA:". It returns a 404, but the goal is to get the payload written into the access log. GET /logon/LogonPoint/custom/receiver.min.<hex>.css
2
17
2,256
Load more