Dailydave mailing list archives
Owning Citrix & Terminal Services Clients
From: DSquare Security <info () d2sec com>
Date: Wed, 27 Feb 2008 12:17:32 -0600
Several vulnerabilities can help you to compromise a Citrix server or a Terminal Services server. So the question is: what can you do when you have a privileged access on these Citrix and Terminal Services servers? The answer is simple: try to compromise Citrix and TS clients. There are at least two interesting ways to access client data 1) Spying his session to get passwords from a published application 2) Accessing his local drives if they are mapped in the session D2CiTerm is designed to help you in this kind of work. Here are two demonstrations of this tool: 1) From a remote SYSTEM access after the exploitation of Citrix MPS 4.0 IMA Service Heap overflow: http://www.d2sec.com/d2citerm_1.htm 2) From a privileged Citrix session: http://www.d2sec.com/d2citerm_2.htm This tool will be released in the next update of D2 Exploitation Pack. -- DSquare Security, LLC http://www.d2sec.com _______________________________________________ Dailydave mailing list Dailydave () lists immunitysec com http://lists.immunitysec.com/mailman/listinfo/dailydave
Current thread:
- Owning Citrix & Terminal Services Clients DSquare Security (Feb 27)
- Re: Owning Citrix & Terminal Services Clients Dave Korn (Feb 28)
- <Possible follow-ups>
- Re: Owning Citrix & Terminal Services Clients Hamid . K (Mar 05)