The Pitboss Pipeline: NetScaler Log Poisoning and a FreeBSD Sliver Implant

Scripts in headers, commands in later requests

Three groups of exploit requests reached NetScaler Gateways between September 28th and October 2nd: two-step INDEX: scripts, plain-text copy-and-fetch commands from Tor, and a loader download from a host under the same parent domain as the configured C2 of a FreeBSD Sliver implant.

On September 29th and 30th, two sources sent NetScaler exploit requests in two stages. First, a User-Agent header carried an encoded script: the text INDEX: followed by Base64, such as INDEX:bWtkaXIgLXAgL3Zhci92cG4vYm9va21hcmsv…, which the gateway records in its log. Then separate login requests paired decoder commands with Pitboss failure text recognized by NetScaler's vulnerable log processor.

INDEX: in the User-Agent values received

The full script templates carry the Nx-zD marker. That marker, matching script structure, and shared trigger text link the activity from 82[.]167[.]14[.]7 and 130[.]12[.]182[.]7. The second source's Nx_zD script matches three from the first source apart from the file tag. Both sources requested /vpn/bookmark/Nx_zD.html 36 minutes apart.

The eight decoded scripts contain commands to write verification markers and PHP handlers to appliance web paths. Five full templates also contain commands to create Perl CGI files and enable PHP and CGI handling in /etc/httpd.conf. The Perl write commands resolve to empty files.

Tor-routed configuration-copy and fetch requests

Later on September 29th, seven Tor-routed sources used the same Pitboss trigger format with the command in plain text instead of an encoded script: four copies of the appliance configuration, /nsconfig/ns.conf, to web paths, followed by a fetch request for /p through a forwarding hostname. All seven carried a variant in User-Agent; five also submitted one in login. The commands save the response as /tmp/.p and pass that path to nohup sh.

Three Serveo hostnames and one Pinggy hostname encode the same forwarding address, 77[.]247[.]126[.]239. All seven sources presented JA4 t13i9012h1_c6771aded2ed_57a60bdf03d1, which matches no standard client such as Python, curl or Node.js, and was also seen from 22 sources in 30 days.

Two loader versions and a FreeBSD Sliver implant

On October 2nd, a separate source, 51[.]158[.]203[.]95, sent requests with the same Pitboss failure text and a command that downloads a script from f[.]pylrk[.]cc and runs it. The URL returned a 297-byte shell loader at 12:32 UTC and a different 443-byte loader at 18:31 UTC.

Both loaders contain commands to fetch and run a file from one payload URL on that host. The second loader's commands write the download to /nsconfig/.nsl, record uname -srm under the LogonPoint directory, start the file with nohup, and append a boot entry to /nsconfig/rc.netscaler, which NetScaler runs at every restart.

A FreeBSD build of Sliver, the open-source command-and-control (C2) framework, uses www[.]pylrk[.]cc as its only configured C2. That hostname shares the delivery host's parent domain, registered at 06:56 UTC the same day. Static analysis shows HTTPS with a plain-HTTP fallback and 16 message handlers covering command execution, file transfer, an interactive shell, and tunnels.

Defender-visible markers

Search URL-decoded request bodies and User-Agent values for pitboss PPE unexpectedly died NSPPE and pitboss PPE missed too many heartbeatsNSPPE. Search access logs for INDEX: followed by Base64 in User-Agent. Exclude authorized test sources.

From the authorized NetScaler BSD shell, search for Nx_*, nx_verify.html, nx_proof.html, x.php, c88771_*.txt, wt88771*.txt, /var/tmp/wtw888, and /tmp/.p. Compare /etc/httpd.conf with a known-good copy for unexpected php_engine on or AddHandler cgi-script .pl lines.

Search DNS and TLS logs for the appliance's traffic to pylrk[.]cc. Look for /var/tmp/.host, /nsconfig/.nsl, /var/nslog/.nsl, ns_ctx.html under LogonPoint, and unexpected nohup lines in /nsconfig/rc.netscaler.

Preserve evidence before applying the Citrix CTX697096 fixes (14.1-73.37 or 13.1-64.23). Rebuild an appliance with a confirmed malicious file or unauthorized boot entry from a known-good image. Open the Full Report tab for hashes, samples, and detections.