Penetration Testing mailing list archives
Re: Citrix Pen Test,
From: sherwyn.williams () gmail com
Date: Wed, 30 May 2007 23:24:09 +0000
Also try right clicking on the desktop and select create short cut then type C:/ and you should get in. Sherwyn Williams Technical Support The Williams Solutions -----Original Message----- From: "rajat swarup" <rajats () gmail com> Date: Wed, 30 May 2007 09:00:14 To:IRM <irm () iinet net au> Cc:pen-test () securityfocus com Subject: Re: Citrix Pen Test, On 5/28/07, IRM <irm () iinet net au> wrote:
On my recent pen-test, I need to deal with an application that sitting on the remote host. The way its works is that the client need to connect to the remote server through Citrix and run the application. 1) I feel that this is quite challenging pen-test as I do not have full control to the remote server. This gets me thinking that apart from analyzing the traffic from the client PC to remote host and input validation checking. Is there any thing that I could possibly do? 2) I noticed that the Citrix Client (Citrix Program Neighborhood 7) used Basic Level encryption. I couldn't find anything in regards to this Basic Level Encryption as to which algorithms that Citrix uses. I was wondering whether this Basic Encryption could be cracked easily. Any thought around this?
Can you break out of the browser and execute commands on the system. The best way to go about this is to use the browser help. Once you have the help there are certain shortcuts that allow you to execute microsoft office applications. If you can have word / excel you could type in C:\Windows\System32\cmd.exe and it would show up as a hyperlink. Click on it to have remote shell. Then you can use the standard windows privilege escalation procedures to elevate your access privilege. HTH, -- Rajat Swarup http://rajatswarup.blogspot.com/ ------------------------------------------------------------------------ This List Sponsored by: Cenzic Are you using SPI, Watchfire or WhiteHat? Consider getting clear vision with Cenzic See HOW Now with our 20/20 program! http://www.cenzic.com/c/2020 ------------------------------------------------------------------------
Current thread:
- Most Successful Exploits/Tools to use against windows & Linux? Pen Testee (May 25)
- Re: Most Successful Exploits/Tools to use against windows & Linux? Morgan Reed (May 25)
- Re: Most Successful Exploits/Tools to use against windows & Linux? nnp (May 27)
- Citrix Pen Test, IRM (May 29)
- Re: Citrix Pen Test, rajat swarup (May 30)
- Re: Citrix Pen Test, Lee Lawson (May 30)
- Re: Citrix Pen Test, sherwyn . williams (May 30)
- Re: Citrix Pen Test, rajat swarup (May 30)
- Citrix Pen Test, IRM (May 29)
- Re: Citrix Pen Test, Sat Jagat Singh (May 30)