Gather a list of Citrix appliances in a country / state pair, and check if they're vulnerable to CVE-2019-19781# shitsniffer
Gather a list of Citrix appliances in a country / state pair, and check if they're vulnerable to CVE-2019-19781. Results are output as JSON which can be wrangled quite nicely into a meaningful PowerBI report.
It does this by querying Shodan for all results in a particular country matching a search string. By default, it searches `country:AU has_ssl:true` with the search string `"Set-Cookie: pwcount=0"`
To check for vulnerability, we see if a `HEAD` for `https://<HOST>/vpn/%2E%2E/vpns/cfg/smb.conf` returns a status `200`. This means directory traversal is allowed, and the patch or workaround has not been applied to the host.
## Setup
You'll need to download the GeoLite2 ASN and City DBs, which will resolve details on discovered hosts. You can find the downloads here: https://dev.maxmind.com/geoip/geoip2/geolite2/
Place the .mmdb files into a folder named geolite under where you extracted shitsniffer.py
## Usage
```
usage: shitsniffer.py [-h] [-t TARGETHOST] [-f RESULTSFILE] [-d DATAFILE]
[-a APIKEY] [-c COUNTRY] [-s SEARCHSTRING] [-n]
[-l LIMIT]
OPTIONS:
-h, --help show this help message and exit
-t TARGETHOST, --targethost TARGETHOST
Host to check, will scan shodan if not specified
-f RESULTSFILE, --resultsfile RESULTSFILE
Where to save the scanner output json file
-d DATAFILE, --datafile DATAFILE
Path to save/load shodan data file (saves query
credits)
-a APIKEY, --apikey APIKEY
Your shodan.io API key
-c COUNTRY, --country COUNTRY
Country to search
-s SEARCHSTRING, --searchstring SEARCHSTRING
Additional search arguments
-n, --no-color Output without color
-l LIMIT, --limit LIMIT
Process this many hosts from shodan data
Example: python shitsniffer.py -a <API key> -d shodan-DDMMYY.json -f output-DDMMYY.json
```
## Thanks
Thanks goes to Diverse Services for allowing me time to indulge myself with this endeavour.
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view