karl/citrixpot
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document supported vectors, simulation capabilities and coverage matrix

Browse Source
This commit is contained in:
StasonJatham committed 2026-10-04 07:03:28 +02:00
1 parent 4da3f54e77
commit 42561bfa34
1 file changed
+84 -16
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+84 -16
View File
@@ -1,9 +1,9 @@
# CitrixPot — NetScaler / Citrix ADC Gateway honeypot (CVE-2019-19781, CVE-2026-88771, CVE-2026-88772)
# CitrixPot — NetScaler / Citrix ADC Gateway honeypot
A self-hosted, dependency-free **Citrix NetScaler / Citrix ADC / Citrix Gateway honeypot** for
defensive **threat intelligence**. It impersonates the NetScaler Gateway login and the
documented log-poisoning command-injection path, records everything attackers send, and — in
simulation mode — **never executes attacker commands**. It is a decoy for catching Citrix
documented log-poisoning command-injection path, records requests that reach its bounded
collector, and — in simulation mode — **never executes attacker commands**. It is a decoy for catching Citrix
exploit attempts, not a real appliance and not a vulnerability scanner.
> **Keywords:** Citrix ADC honeypot, NetScaler Gateway honeypot, Citrix command injection,
@@ -113,19 +113,87 @@ Checks: `python3 test_nitro.py`, `python3 test_capture.py`, `python3 test_honeyp
`python3 test_safety.py`. Optional execution tools described below are incompatible with
`--simulation-only` and are not used by the supplied HTTP service.
- Serves a realistic **NetScaler Gateway / Citrix ADC login** (German AAA page) at `/`,
`/vpn/index.html`, `/vpn/tmindex.html`, `/logon/LogonPoint/*`, `/menu/neo/`, with the
`rdx`/`CTXS` scripts and favicon fingerprint that scanners look for.
- Implements the **published log-to-command injection** trigger and records every candidate;
extracted commands are answered with **simulated** output.
- Stores **every request, header, body and response** as evidence, plus **every uploaded
payload** byte-for-byte.
- Optionally **downloads payload URLs** found in attacker commands (HTTP(S) GET only) and stores
them as inert assets. Nothing is ever piped or executed.
- Includes a **local, read-only analyst web UI** with paged full-text search and raw payload
hex/text view.
- Can optionally run commands in a **disposable, network-restricted guest** for real payload
behaviour (off by default; never on a public listener).
### Supported intake vectors
“Captured” means evidence is retained within the limits below. It does not mean a real
vulnerability exists, a payload executes, or a CVE is conclusively identified.
| Input surface | Capture and analysis capability |
| --- | --- |
| HTTP methods and request targets | GET, HEAD, POST, PUT, DELETE, OPTIONS and other parsed method names; original URI/query and HTTP version. Unknown routes still accept body capture before returning404. Method support in simulated APIs is narrower. |
| Headers and cookies | Raw header pairs, including duplicates that reach the collector, User-Agent, Cookie, custom headers and proxy evidence aliases. Crash-log markers, encoding hints and headers over8KiB produce private hunt labels. |
| URL/query probes | Traversal/encoded traversal, appliance-configuration paths, management paths and SAML query fields. Original URI is retained independently of decoded indicators. |
| URL-encoded forms | Original body plus decoded field pairs, login/password submissions and SAML envelopes. Fields can feed the bounded textual command simulator. |
| Multipart forms/uploads | Original multipart body, individual field/file bytes, submitted filename, field name, MIME type and parser defects. Filenames are metadata, never host paths. |
| JSON/API payloads | Original JSON bytes; NITRO systemfile.filecontent additionally becomes a base64-decoded file artifact. Other JSON is captured even if not recognized by the simulator. |
| Binary/raw uploads | Exact accepted body bytes regardless of executable format or extension; content-addressed inert storage. No malware execution or unpacking. |
| Chunked requests | Accepted chunked bodies are decoded for body artifacts; consumed origin framing and accepted trailers remain separate evidence. Proxy framing may differ from the client connection. |
| SAML POST/Redirect bindings | SAMLRequest/SAMLResponse base64 artifacts from forms and queries, plus bounded raw-DEFLATE expansion for query bindings. Invalid encodings/limits are recorded; no XML parsing or authentication. |
| Malformed/interrupted requests | Rejection/interruption events and consumed partial wire bytes where available. Unread bytes and requests rejected at the edge cannot be recovered. |
| Outbound-command intent | Recognized network-tool commands in the textual simulator are recorded as outbound attempts; strict capture-only mode makes no connection or download. |
### Simulated endpoints and behavior
| Surface | Supported response behavior |
| --- | --- |
| Gateway login pages | `/`, `/vpn/`, `/vpn/index.html`, `/vpn/tmindex.html`, `/logon/LogonPoint/index.html`, `/logon/LogonPoint/tmindex.html`, `/logon/LogonPoint/custom.html`, `/menu/neo/`. German login UI, canonical Citrix Gateway title, NSC_ cookie and Gateway-shaped response headers. |
| Gateway static fingerprints | Explicit rdx/CTXS JavaScript routes, login.js/init.js, original favicon/logo/background assets and AccessGateway.ico alias. Only routes in STATIC are supported; arbitrary files under these directories return404. |
| Language/version fingerprints | English/German JSON and `.json.gz` under `/vpn/js/rdx/core/lang/` and `/vpn/js/rdx/core/lang-ext/`; gzip filename, build timestamp, Content-Encoding and Last-Modified. Synthetic translation subset with the default14.1-29.63 metadata. |
| Authentication XML | `/nf/auth/*` returns credential requirements, state context and local postback. This is a repeated login challenge, not LDAP, SAML, MFA or successful real authentication. |
| NITRO authentication | `/nitro/v1/config/login` and logout with synthetic session tokens. Resource access accepts a matching fake token, nonempty X-NITRO-USER/X-NITRO-PASS, or a Basic authorization prefix. These are decoy rules, not real user/account validation. |
| NITRO resources | `/nitro/v1/config/<resource>[/<name>]` and `/nitro/v1/stat/<resource>[/<name>]`;1,493 config and176 statistics names in [nitro-resources.json](nitro-resources.json). Common system/network/Gateway/AAA/SSL/LB/binding records are populated; other recognized resources return empty collections or generic counters. |
| NITRO operations | Config reads, fake POST/PUT/DELETE, enable/disable/rename, inert administrative-action acknowledgements, attrs, literal filter/args, counts, pagesize and pageno. Unknown resources, invalid input, unsupported methods and unauthenticated access return simulator errors. |
| Textual command simulation | Approximate log-poisoning marker extraction from URI, headers and decoded form fields. Bounded shell-like grammar supports id, whoami, uname, pwd, cd, cat, ls, echo, selected printf formats, touch, rm and simple redirects in per-source memory. mkdir/true/colon are acknowledgements; unsupported commands are recorded. No real shell or filesystem access. |
| Private/uploaded paths | The supplied public service uses --hide-guest-files: evidence, source, viewer and uploaded files are not served by the honeypot. Unknown `.env`, PHP, GraphQL and other application paths return404 while incoming requests remain captured. |
### CVE/vector coverage status
This matrix describes collection and simulation coverage, not an exploit implementation or
a guarantee of detecting every variant. Generic indicators must be corroborated manually.
| Advisory/vector | Current coverage |
| --- | --- |
| CVE-2019-19781 | Conservative Gateway/vpns path labels and raw traversal-request capture; no vulnerable template engine or actual traversal. |
| CVE-2026-88771 | HTTP header/form/URI capture, crash-log markers, approximate textual command extraction and inert responses. No real log-to-shell execution or full multi-stage chain emulation. |
| CVE-2026-19490 | Gateway/AAA and SAML-envelope intake; no real authentication-bypass reproduction or dedicated definitive CVE signature. |
| CVE-2026-88779 | SAML original/decoded evidence with bounded inflation; no SAML SP/IdP engine, memory-overflow reproduction or dedicated definitive CVE signature. |
| CVE-2026-88773 /88774 /88775 | Generic HTTP framing, URL and size-related evidence where it reaches the collector. No NetScaler request-smuggling, policy engine or memory-corruption emulation. |
| CVE-2026-88772 | DTLS/UDP collection is not implemented or active; HTTP follow-up requests can still be captured. |
| CVE-2026-19489 /88776 /88777 /88778 | SIP ALG, Oracle/non-HTTP protocol and TCP sequence-number behavior are not emulated. |
| Other Citrix vectors, including CitrixBleed | HTTP requests can be retained, but unlisted vectors have no promised dedicated detector or vulnerable response simulation. No real memory or session-secret disclosure. |
Advisory references: [CTX697096](https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.htm),
[CTX696939](https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html),
[CTX697174](https://support.citrix.com/external/article?articleNumber=CTX697174).
### Evidence, attribution and operations
- JSONL schema-v2 events link requests, responses, uploads, indicators and simulated actions
by request_id/session, timestamp and peer metadata. SHA256 artifacts are deduplicated,
stored0600 under a0700 directory and committed with fsync/atomic rename.
- Trusted-hop PROXYv1 and forwarded-header handling retain effective client identity and
proxy provenance; untrusted identity headers are ignored. The original visitor's TCP source
port is not recovered through HTTP proxies.
- Private auth_attempt events count per-source attempts in a300-second window;
brute_force_suspected begins at10 attempts. No public lockout, alert or response change.
- Loopback read-only viewer supports paging, event/source filters, multi-term search,
escaped text/hex inspection and artifact download. Public evidence routes stay unavailable.
- Ordinary service crashes restart after5seconds; evidence failures set STOP/exit78.
No automatic evidence deletion, backups or remote telemetry are added.
| Bound | Default/current implementation |
| --- | --- |
| Accepted request body |16MiB; received header names/values capped at32KiB after HTTP parsing. Earlier parser/proxy limits also apply. |
| Concurrent requests |8 |
| Form/query decoding |64KiB and128 fields; multipart processing stops after128 visited MIME parts. |
| Indicator body inspection / SAML inflation |First64KiB / maximum64KiB; larger accepted bodies remain raw evidence. |
| Per-source sessions |128 sessions, one-hour inactivity TTL; in-memory state resets on restart and NAT may merge users. |
| Fake config / simulated files |64KiB serialized config state;64 virtual files,8,192 text characters each;16 pending commands per session and32 parsed command groups per simulation. |
| Storage |Configurable evidence quota; fails closed at quota or storage errors rather than silently dropping evidence. |
Legacy VM-execution and URL-fetch tools remain in the repository for separate lab use.
They are incompatible with --simulation-only, disabled in the supplied public service,
and are not part of the supported capture-only capability set above.
## Architecture