Re: Citrix Pen Test,



I don't think that Rajat explained that very well!

Citrix effectively presents the desktop as a web page. All desktop
shortcuts are really just images on that web page. Right click on one
of those desktop shortcuts and click on properties (I think it's
properties), edit the application to point to
C:\Windows\System32\cmd.exe instead of the original program such as
word.exe etc. Then when you double click on the original desktop
shortcut, cmd.exe will pop up instead.

Fine, but you are still running under the security context of your
account. It is recommended that a Citrix administrator reduce their
attack surface by only publishing programs that they want their users
to have instead of publishing all programs.

You may also be able to open IE and enter the address of: %comspec% to
get a command prompt too. But you are still operating under your
regular account.

If your account has the persmission to execute the AT command within a
command prompt then you may be able to elevate your privileges. The
AT command is only, by default assigned to the Admin accounts, but if
you can run it, do this:
c:\>at HH:MM /interactive "cmd.exe"
Where HH:MM is a time just a minute in the future. When the AT
command executes, a command prompt shell will pop up that is running
at SYSTEM level.

Of course, this is all pointless as only the Admin accounts have
access to the AT command by default, but if someone has configured it
so that users can execute AT, then game on! Also, it's really handy
for shutting down AV software that tends to run at SYSTEM.

lee.

On 5/30/07, rajat swarup <rajats@xxxxxxxxx> wrote:
On 5/28/07, IRM <irm@xxxxxxxxxxxx> wrote:
>
> On my recent pen-test, I need to deal with an application that sitting
> on the remote host. The way its works is that the client need to connect
> to the remote server through Citrix and run the application.
>
> 1) I feel that this is quite challenging pen-test as I do not have full
> control to the remote server. This gets me thinking that apart from
> analyzing the traffic from the client PC to remote host and input
> validation checking. Is there any thing that I could possibly do?
>
> 2) I noticed that the Citrix Client (Citrix Program Neighborhood 7) used
> Basic Level encryption. I couldn't find anything in regards to this
> Basic Level Encryption as to which algorithms that Citrix uses. I was
> wondering whether this Basic Encryption could be cracked easily. Any
> thought around this?

Can you break out of the browser and execute commands on the system.
The best way to go about this is to use the browser help. Once you
have the help there are certain shortcuts that allow you to execute
microsoft office applications. If you can have word / excel you could
type in C:\Windows\System32\cmd.exe and it would show up as a
hyperlink. Click on it to have remote shell. Then you can use the
standard windows privilege escalation procedures to elevate your
access privilege.

HTH,
--
Rajat Swarup

http://rajatswarup.blogspot.com/

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!

http://www.cenzic.com/c/2020
------------------------------------------------------------------------




--
Lee J Lawson
leejlawson@xxxxxxxxx

"Give a man a fire, and he'll be warm for a day; set a man on fire,
and he'll be warm for the rest of his life."

"Quidquid latine dictum sit, altum sonatur."

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!

http://www.cenzic.com/c/2020
------------------------------------------------------------------------



Relevant Pages

  • Re: Fenster versenken, wie?
    ... Shortcuts for taking Pictures of the Screen ... Go to Computer Command + Shift + c ... Close folder Command + Up Arrow ... Turn on full keyboard access Ctrl + F1 ...
    (de.comp.sys.mac.misc)
  • Re: Overtaxed on moving day
    ... >> And moving a stash six dungeon levels is not far at all. ... >> you know the move '_' command? ... use the shortcuts to go to the nearest ... Because the help command is for help, ...
    (rec.games.roguelike.nethack)
  • Re: Quick Print in Word 2007
    ... multiple keystroke shortcuts; what it does is list the same command twice, each with one of the shortcuts. ... At a quick glance, though, I don't see some keystroke shortcuts that I know exist, such as the en and em dashes. ... then under "Macros in" select "Word commands", then select "ListCommands" for macro name, and choose "All Word commands" in the next dialogue, you will get a new document with a table of all the commands showing built-in keyboard shortcuts. ... I suspect once I did the pasting, the code no longer appeared in the document and hence didn't show up when I printed the key assignments. ...
    (microsoft.public.word.newusers)
  • Re: Quick Print in Word 2007
    ... It lists only "commands," not characters. ... each with one of the shortcuts. ... At a quick glance, though, I don't see some keystroke shortcuts ... maximum of one per command so not Ctrl+W). ...
    (microsoft.public.word.newusers)
  • Re: Executing "rundll32.exe url.dll,FileProtocolHandler <url>" fails
    ... That too fails when typing in command above. ... typing the same command in a cmd shell in an exported Citrix ... ICA connection) succeeds and correctly opens the default browser on the ...
    (microsoft.public.win2000.termserv.apps)