Executive summary
A captured shell payload from http://213.209.159.55:443/t/25ec58 was retrieved and statically analysed. The payload is not an exploit by itself; it is a NetScaler-focused post-exploitation installer intended to preserve access after an appliance has already been compromised.
The script deploys hidden receiver-style web shell files, modifies NetScaler Apache configuration to execute unexpected file types as PHP, sets up persistence through startup and scheduled execution paths, installs local tunneling components, and attempts to exfiltrate NetScaler configuration and backup material.
This behaviour aligns with the current Citrix NetScaler exploitation window around CVE-2026-88771 and CVE-2026-88772, both of which Citrix reports have been exploited on unmitigated deployments.[1] Public research from Google/Mandiant, Unit 42, and Rapid7 describes related WHIPSHOT/SLAPSHOT-style web shell and tunneling activity in the same campaign context.[2][3][4]
Captured sample summary
- Source URL:
http://213.209.159.55:443/t/25ec58 - HTTP result: 200 OK,
Content-Type: application/x-sh, 26,367 bytes - SHA256:
3f43ffdb02a339a09de56e7fefddb422f2f400648b3b1a32d58dce13dd8d5e95 - SHA1:
7098fdc7d5a720959baaa44554a9dcfed8b30133 - MD5:
3e18f5260ea73421c2ea7d6fb68db178 - Assessment: malicious NetScaler post-exploitation tooling; high confidence
Why this matters
The payload attempts to survive reboot and configuration regeneration by re-seeding scheduled execution and startup hooks.
The payload contains local session/tunneling components that can make connections from the compromised appliance into internal networks.
The payload attempts to archive and upload NetScaler configuration and backup material, which may contain authentication, certificate, and infrastructure secrets.
Observed behaviour
Hidden appliance staging
The script creates hidden working locations under NetScaler configuration, temporary, and web customisation paths. These locations are used for dropped Perl, Python, shell, and PHP components.
Receiver-style PHP web shell
The payload writes hidden receiver-themed files into the NetScaler logon customisation path. The PHP receiver deliberately returns a 404-style response and executes commands only when a specific cookie token is supplied.
Apache configuration modification
The script alters httpd.conf so hidden receiver files and a disguised Debian-package-style filename can be handled as PHP. It also adds alias patterns that expose the hidden receiver through legitimate-looking NetScaler logon paths.
Root-capable execution
The payload attempts to set SUID/SGID permissions on /bin/sh. If successful, this allows later commands invoked from lower-privileged web contexts to regain root effective privileges.
Local tunneling and proxying
The sample embeds TCP session-manager and HTTP-front components that implement open, send, receive, exchange, close, and health-check style operations. This gives the operator a way to originate TCP sessions from the appliance into internal networks.
Configuration theft
The script archives and uploads NetScaler configuration, historical configuration files, system backup archives, Apache configuration, diagnostics, and selected recent logs back to the same staging infrastructure.
Campaign context
Citrix CTX697096 documents eight NetScaler ADC and Gateway vulnerabilities, including CVE-2026-88771 and CVE-2026-88772. Citrix states exploitation of those two vulnerabilities has been observed on unmitigated deployments and provides fixed version guidance.[1]
Google/Mandiant describe current NetScaler intrusions involving WHIPSHOT, a PHP web shell, and SLAPSHOT, a Python tunneling tool used to bridge access into internal networks after appliance compromise.[2] Unit 42 separately describes command-injection exploitation leading to web shell deployment, Apache configuration changes, and SUID shell abuse.[3] Rapid7 reports observed exploitation activity and appliance configuration theft patterns in this vulnerability window.[4]
The captured payload is consistent with that public reporting, but this page does not attribute the sample to a named actor. Shared infrastructure, copied tooling, and opportunistic reuse are all plausible.
Public indicators
- IP:
213.209.159.55 - URL:
http://213.209.159.55:443/t/25ec58 - HTTP scheme/port note: cleartext HTTP observed on TCP/443
- ASN:
AS208137, Feo Prest SRL - SHA256:
3f43ffdb02a339a09de56e7fefddb422f2f400648b3b1a32d58dce13dd8d5e95 - Notable path fragments:
/nsconfig/.slap,/var/tmp/.ux,.slap.receiver,.ctxs.receiver,receiver.deb,receiver.v2.min.css - Notable file/config fragments:
httpd.conf.slap.bak,AddType application/x-httpd-php .deb,SetHandler application/x-httpd-php
Defensive actions
- Treat matches as compromise: if these files, path fragments, Apache changes, SUID shell changes, or outbound uploads are present on a NetScaler appliance, handle it as a confirmed compromise rather than a scan.
- Preserve first: where operationally possible, preserve forensic evidence before rebooting, rebuilding, or patching over artefacts. Appliance updates can reduce forensic visibility.
- Validate fixed builds: confirm NetScaler versions against Citrix fixed-release guidance for CVE-2026-88771 through CVE-2026-88778.[1]
- Inspect configuration drift: review Apache configuration, NetScaler startup scripts, scheduled tasks, hidden web files, temporary directories, and unexpected local listeners.
- Investigate egress: hunt for appliance-originated connections to the staging IP and for unusual internal TCP sessions from NetScaler source addresses.
- Rotate exposed secrets: if configuration or backup exfiltration is suspected, rotate appliance administrator credentials, LDAP/RADIUS/TACACS bind credentials, API keys, certificates/private keys as appropriate, and any downstream secrets stored in appliance configuration.
SOC watchpoints
- Outbound HTTP/PUT or unusual HTTP-over-443 from NetScaler appliances to untrusted internet infrastructure.
- Requests to NetScaler logon customisation paths that return 404 but have abnormal body sizes, headers, cookies, or timing.
- Unexpected NetScaler-originated sessions to internal management, directory, database, or application services.
- Configuration changes adding PHP handling for unexpected file extensions or hidden receiver-themed files.
- Presence of hidden directories, receiver-themed payload names, unexpected SUID shell permissions, or persistence entries referencing hidden appliance paths.
Endpoint EDR visibility inside appliances is usually limited. Prioritise appliance logs, syslog, firewall/proxy telemetry, configuration diffing, packet captures where available, and vendor-supported forensic collection.
ATT&CK mapping
- T1190 — Exploit Public-Facing Application
- T1505.003 — Web Shell
- T1053 — Scheduled Task/Job
- T1547 — Boot or Logon Autostart Execution
- T1090 — Proxy
- T1021 — Remote Services, where tunneling enables follow-on internal access
- T1005 — Data from Local System
- T1041 — Exfiltration Over C2 Channel
Limitations
- This page is based on static analysis of a captured payload retrieved on 2026-10-02 UTC. The script was not executed.
- The payload does not prove which specific CVE was used for initial access against any victim.
- The report intentionally omits exploit procedure, full script content, and sensitive operational details.
- Public-source reporting is cited for campaign context; first-party sample analysis is based on the captured payload itself.
Sources
- [1] Citrix CTX697096: NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778
- [2] Google Cloud / Mandiant: Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
- [3] Unit 42: NetScaler Zero Days Exploited
- [4] Rapid7: Zero-Day Exploitation of Citrix NetScaler ADC and Gateway
Bottom line
This captured payload shows what defenders should expect after successful NetScaler exploitation: persistent web shell access, local tunneling for internal reach, appliance configuration theft, and attempts to retain root-capable execution. Any matching artefact on a production appliance should trigger incident response, credential rotation, and vendor-supported compromise assessment.