Author Archives: Nathan Noll

In this post, we will cover a privilege escalation that I found in the Intel Trusted Connect Service Client. The Connect Service Client is part of Intel Management Engine Components and is designed to permit a non-privileged user to become system. After communicating with Intel about the vulnerability, it was discovered that this was already…

The post Finding a Privilege Escalation in the Intel Trusted Connect Service Client appeared first on TrustedSec.

Continue reading Finding a Privilege Escalation in the Intel Trusted Connect Service Client→

The Citrix NetScaler remote code execution vulnerability (CVE-2019-19781) has been a pretty popular topic over the last few weeks. Once public exploits of the vulnerability started to appear in the wild, TrustedSec deployed a Citrix NetScaler honeypot. We did not have to wait long for the attacks to begin. Less than 24 hours after deployment,…

The post NetScaler Honeypot appeared first on TrustedSec.

Continue reading NetScaler Honeypot→

With the recent Citrix ADC (NetScaler) CVE-2019-19781 Remote Code Execution vulnerability, the TrustedSec Incident Response team has been working closely with our offensive and research teams as they created a working exploit. This has allowed us to create a list of locations and indicators to search for on potentially compromised Citrix ADC hosts. Based on…

The post NetScaler Remote Code Execution Forensics appeared first on TrustedSec.

Continue reading NetScaler Remote Code Execution Forensics→

On December 17, 2019, Citrix released a critical advisory that allows for remote code execution. Advisories like these come out often for organizations, and critical exposures are nothing new for any company. However, when digging into the remediation step details, this advisory gave a substantial amount of information on the exploit itself. What makes this…

The post Critical Exposure in Citrix ADC (NetScaler) – Unauthenticated Remote Code Execution appeared first on TrustedSec.

Continue reading Critical Exposure in Citrix ADC (NetScaler) – Unauthenticated Remote Code Execution→

There is an old rule that if you find yourself doing anything more than twice, you should automate it. For developers, this may be software builds or the environments into which they will be deployed; for penetration testers, it may be the need to create a phishing host or a lab environment for testing. In…

The post Automation Testing With Ansible, Molecule, and Vagrant appeared first on TrustedSec.

Continue reading Automation Testing With Ansible, Molecule, and Vagrant→