Skip to content

Back to the catalog

CITRIX 0-DAY EXPLOITS: CVE-2026–88771 & CVE-2026–88772 IN THE WILD
theravenfile.comwriteup

CITRIX 0-DAY EXPLOITS: CVE-2026–88771 & CVE-2026–88772 IN THE WILD

An incident-response style deep dive into active in-the-wild exploitation of Citrix NetScaler ADC/Gateway via CVE-2026-88771 (unauthenticated RCE through log-poisoning of ns_monuploadd_err.pl) and CVE-2026-88772 (DTLS memory overflow), part of 8 CVEs disclosed by Citrix on September 27, 2026. The author reverse-engineers the full post-exploitation toolkit dropped after root is obtained: SLAPSHOT (a Perl/Python loopback TCP tunneler/pivot), WHIPSHOT (a disguised PHP web shell served via fake CSS paths), the Platypus C2 agent, and a Perl "Pitboss" dropper script (with full decoded source and an embedded SHA-256-protected PHP web shell) that creates a rogue superuser, SUIDs /bin/sh, exfiltrates NetScaler config, and patches httpd.conf for persistence. It closes with extensive IOCs (C2 IPs, file hashes, paths, credentials) and patch guidance for affected NetScaler builds.

TL;DR Deep technical breakdown of active Citrix NetScaler 0-day exploitation (CVE-2026-88771/88772) with full code analysis of the SLAPSHOT tunneler, WHIPSHOT web shell, Platypus C2 agent, and a Perl rootkit dropper, plus extensive IOCs.
Open original ↗
Document

What it is

This is a forensic breakdown of the four post-exploitation tools dropped after root is obtained on compromised Citrix NetScaler via CVE-2026-88771 / CVE-2026-88772: SLAPSHOT (a Perl/Python loopback TCP session multiplexer), WHIPSHOT (a disguised PHP web shell), the Platypus C2 agent, and a Perl dropper script the page calls "Pitboss" (unrelated to the legitimate NetScaler pitboss watchdog daemon, whose SIGSEGV/SIGBUS-neutralizing bypass technique is described separately).

How it works

SLAPSHOT's agent.pl/slapshot.py listens only on loopback and supports open/push/pull/exch/close/stat/ping commands, with data base64-encoded over the local socket; a bridge.pl client reads the listening port from /tmp/.uxdport to relay commands. Because outbound connections originate from the NetScaler's own NSIP/SNIP, the traffic blends in as normal ADC traffic. The Pitboss dropper script (fully decoded in the page) creates superuser sec_monitor using NetScaler's native PBKDF2 (2500 iterations) hash format written directly into /flash/nsconfig/ns.conf, tars and HTTP-POSTs /flash/nsconfig to 64.94.85.67:443 as update_result_3567cs.tgz, sets chmod 6555 /bin/sh, writes a base64-embedded PHP web shell to /var/netscaler/logon/LogonPoint/.local_journal, patches /etc/httpd.conf with <Files>/Alias/AliasMatch directives so .local_journal is served at the fake CSS path /logon/LogonPoint/css/LogonUISimple.html.style.min.css, flips php_flag engine on, then sends SIGHUP to httpd's PID (read from /var/run/httpd.pid) to reload, and self-deletes.

Preconditions / Affected

Requires root already obtained via the two CVEs. NetScaler ADC/Gateway 14.1 (12.x–73.36) and 13.1 (4.x–64.22), plus FIPS builds before 14.1-73.37 and 13.1-FIPS/NDcPP builds before 13.1-37.279.

What to do

  • Patch to 14.1-73.37, 13.1-64.23, or FIPS/NDcPP equivalents (14.1-73.37 FIPS, 13.1-37.279).
  • Hunt for files: /nsconfig/.slap/, /var/tmp/.ux/, /tmp/.uxdlock, /tmp/.uxdport, /var/netscaler/logon/LogonPoint/custom/.slap.receiver, .ctxs.receiver, receiver.deb, /var/netscaler/logon/LogonPoint/.local_journal, /var/tmp/.ns_data, /etc/httpd.conf.slap.bak.
  • Check for rogue superuser sec_monitor in ns.conf; check /bin/sh for SUID bit (6555).
  • Check httpd.conf for injected <Files>/Alias/AliasMatch blocks referencing .local_journal or LogonUISimple.html.style.min.css and any php_flag engine on flips.
  • Block/alert on C2 IPs 213.209.159.55, 64.94.85.67, 62.133.62.80, 31.56.197.72, 23.27.143.20, 45.141.21.130 and domain entretiensol.com.
  • Hardcoded web shell password QI@UEG5PC7oRt31E (SHA-256 e4d909c290d0fb1ca068ffaddf22cbd0) and SLAPSHOT auth token 072874c28950cf7befd319d17e9709e7 can be used as exact-match detection strings.

Caveats

The author states the SLAPSHOT script section is "truncated" and its continuation (web shell drop, cron persistence, httpd.conf patch, exfil) is inferred ("almost certainly") rather than directly observed in that sample. IP geolocation diversity is explicitly noted as not indicating a single campaign/actor.

Organisations named here

  • entretiensol.com
  • Pitboss

CVEs named here

  • CVE-2026-88771
  • CVE-2026-88772
  • CVE-2026-88773
  • CVE-2026-88774
  • CVE-2026-88775
  • CVE-2026-88776
  • CVE-2026-88777
  • CVE-2026-88778

Technologies named here

  • NetScaler ADC
  • YARA
  • NetScaler Gateway
  • Chisel
  • Sliver
  • GreyNoise
  • Shodan
  • Censys
  • VirusTotal
  • Citrix NetScaler
  • PHP
  • Python
  • Perl
  • Platypus

Techniques named here

  • Memory overflow exploitation over UDP/DTLS
  • Rogue superuser account creation
  • SUID backdoor
  • Config exfiltration
  • Web shell masquerading via httpd.conf modification
  • Watchdog/crash-handler neutralization
  • Password-protected PHP web shell with session auth
  • Dual-exploit chaining for redundancy
  • Mass scanning for vulnerable endpoints

Threat actors named here

  • Unnamed/unattributed threat actors
  • SLAPSHOT
  • WHIPSHOT
  • PITBOSS SHELL
  • Platypus Agent

Related in Threat Intel