mandiant/ioc-scanner-cve-2019-19781Indicator of Compromise Scanner for CVE-2019-19781
This repository contains a utility for detecting compromises of Citrix ADC Appliances related to CVE-2019-19781. The utility, and its resources, encode indicators of compromise collected during FireEye Mandiant investigations. To learn more, please read the blog announcing this tool's release.
In summary the utility will:
It will not:
With community feedback, the tool may become more thorough in its detection. Please open an issue, submit a PR, or contact the authors if you have problems, ideas, or feedback.
This scanner can identify:
The Indicator of Compromise (IoC) Scanner for CVE-2019-19781 was jointly developed by FireEye Mandiant and Citrix based on knowledge gleaned from incident response engagements related to exploitation of CVE-2019-19781. The goal of the scanner is to analyze available log sources and system forensic artifacts to identify evidence of successful exploitation of CVE-2019-19781. There are limitations in what the tool will be able to accomplish, and therefore, executing the tool should not be considered a guarantee that a system is free of compromise. For example, log files on the system with evidence of compromise may have truncated/rolled, the system may have been rebooted, an attacker may have tampered with the system to remove evidence of compromise, and/or installed a rootkit that masks evidence of compromise, etc.
The output of the this tool will fall into one of three categories:
Evidence of compromise. This is the default.
Any evidence that falls into this category indicates that a device was successfully compromised.
This could be anything from executing commands that disclosure information (e.g. view the ns.conf or smb.conf configuration files),
to installing a backdoor (e.g. NOTROBIN, a coin miner, etc.),
or dropping a Perl-based web shell.
Evidence of successful vulnerability scanning (this could be authorized system administrator or unauthorized attacker). Any evidence that falls into this category indicates the system was in a vulnerable state (e.g. the mitigation had not been applied) and that at least the first step to exploit CVE-2019-19781 was successful.
Evidence of failed vulnerability scanning. Any evidence that falls into this category indicates that attempts to scan or exploit the system failed.
This tool is not guaranteed to find all evidence of compromise, or all evidence of compromise related to CVE-2019-19781. If indications of compromise are identified on systems, organizations should perform a forensic examination of the compromised system to determine the scope and extent of the incident. This tool is offered AS IS and without warranty.
You should download the standalone Bash script from the Releases tab of this repository. Copying the source directory to a Citrix ADC Appliance is possible but not recommended.
The IoC Scanner can be run directly on a Citrix ADC Appliance.
In this mode, the tool will scan files, processes, and ports for known indicators.
The tool writes diagnostic messages to the STDERR stream and results to the STDOUT stream.
In typical usage, you should redirect STDOUT to a file for review.
The tool must be run as root in live mode on a Citrix ADC Appliance.
For example:
$ sudo bash ./ioc-scanner-CVE-2019-19781-v1.1.sh > "/tmp/results-$(date).txt"
The tool is designed to be used with the following products:
The IoC Scanner can also inspect a mounted forensic image. In this scenario, pass a command line argument specifying the path to the image root directory. You don't have to be root to run in offline mode.
For example:
$ bash ./ioc-scanner-CVE-2019-19781-v1.1.sh /mnt/path/to/evidence/root/
In both modes, the tool will extract supporting code into a temporary directory; this directory will be deleted upon termination of the script. The tool does not make further changes to the system, although it may cause log entries to be generated.
Like all forensic analysis, prefer offline analysis against a dd image to live response.
This will eliminate the likelihood that the tool causes relevant evidence to be overwritten.
Please review the Frequently Asked Questions for further details.
As you invent further ways to identify compromise, please consider contributing to this IoC Scanner. We would like to provide the most thorough, correct scanner as possible.
The primary goal is to report high confidence indicators of compromise. Because users may rely on the output of this tool to initiate further investigation, it's important that we don't send them on a wild goose chase. Therefore, activity such as simple scanning should not be reported in the default mode. Any evidence of an actor gaining access to the system, fetching information, or creating content should always be reported.
We provide this tool as a Bash script because it's a common denominator across Citrix ADC Appliances. Here's the feature matrix for Citrix ADC releases:
| NetScaler Version | OS | Languages available |
|---|---|---|
| 13.0 | FreeBSD 8.4 | Bash, Perl, Python |
| 12.1 | FreeBSD 8.4 | Bash, Perl, Python |
| 12.0 | FreeBSD 8.4 | Bash, Perl, Python |
| 11.1 | FreeBSD 8.4 | Bash, Perl |
| 10.5 | FreeBSD 8.4 | Bash, Perl |
| 10.1 | FreeBSD 6.3 | Bash, Perl |
| 9.3 | FreeBSD 6.3 | Bash, Perl |
Although we've seen malware use Go to target FreeBSD/NetScaler, Go does not support FreeBSD 6.x.