---
title: Hunt: N-central 4EverAble2Shell / Agent2Shell, SessionID -1 SOAP calls, a flag_default.json symlink and CodeDrop files on probes | ctxsec
url: https://ctxsec.com/items/hunt-n-central-4everable2shell-agent2shell-poc-indicators-serverui-serverchild-codedrop
description: "Huntress extracted these indicators from the public exploit code for the two new N-central chains. They apply to unmodified PoC use; a careful attacker can change them, so pair them with a review of admin accounts, scripts and remote sessions since Nov 11."
status: "vendor research (Huntress static analysis of the public PoC, Nov 12, 2026; Huntress says none seen in the wild yet); probing IP from Previdian via The Hacker News"
published: 2026-11-12
---

> Huntress extracted these indicators from the public exploit code for the two new N-central chains. They apply to unmodified PoC use; a careful attacker can change them, so pair them with a review of admin accounts, scripts and remote sessions since Nov 11.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-n-central-4everable2shell-agent2shell-poc-indicators-serverui-serverchild-codedrop.md)

vendor research (Huntress static analysis of the public PoC, Nov 12, 2026; Huntress says none seen in the wild yet); probing IP from Previdian via The Hacker News

2026-11-12 7:40 AM ET

### Hunt: N-central 4EverAble2Shell / Agent2Shell, SessionID -1 SOAP calls, a flag_default.json symlink and CodeDrop files on probes

- **Server web logs:** POSTs to `/dms/services/ServerUI` containing `jline.internal.TerminalLineSettings` (the PoC gets HTTP 500), or `GenericAgentXMPPMessageExchange` with SessionID `-1`; POSTs to `/dms2/services2/ServerMMS2` containing `RemoteExecutionTaskSubmit` with sessionID `-1`.
- **Server files:** `/var/opt/n-central/flag/flag_default.json` as a symlink to `/opt/nable/var/ncsai/scripts/ServerChild.sh`; `/var/opt/n-central/tmp/serverchild-<12 hex>.bak`, `.sh` or `.out`; ZIPs under `/download/scheduled_tasks/output_files/` containing `CodeDropMeta.xml`.
- **Windows endpoints:** `powershell.exe -NoProfile -NonInteractive -EncodedCommand` as SYSTEM spawned by the N-able Agent (PowerShell under the Agent is normal; decode the command); `wsp.exe` or `service.cfg` written to `Windows Software Probe\bin` with a backup at `CodeDrop\ServiceBackup\wsp.exe` and files in `Temp\CodeDropTmp`; `taskkill /f /im wsp.exe` and a stop/start of the Windows Software Probe Service from a `.cmd` in `%TEMP%`.
- **Network:** inbound from, and curl downloads from, `157.20.241[.]16` (Previdian); SOAP faults that name arbitrary classes (Apache Axis CVE-2026-90436 attempts).

Sources: [Huntress: N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains (updated Nov 12, 1:10 AM and 6:30 AM ET)](https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains) · [The Hacker News: New N-central Exploits Work Against Patched Servers (Nov 12, 2026; quotes N-able's advisory and Previdian)](https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html)