[Dailydave] Owning Citrix & Terminal Services Clients

[DSquare Security]

Several vulnerabilities can help you to compromise a Citrix server or
a Terminal Services server. So the question is: what can you do when
you have a privileged access on these Citrix and Terminal Services
servers? The answer is simple: try to compromise Citrix and TS clients.

There are at least two interesting ways to access client data
1) Spying his session to get passwords from a published application
2) Accessing his local drives if they are mapped in the session

D2CiTerm is designed to help you in this kind of work. Here are two
demonstrations of this tool:

1) From a remote SYSTEM access after the exploitation of Citrix MPS 4.0
   IMA Service Heap overflow: http://www.d2sec.com/d2citerm_1.htm

2) From a privileged Citrix session: http://www.d2sec.com/d2citerm_2.htm


This tool will be released in the next update of D2 Exploitation Pack.


-- 
DSquare Security, LLC
http://www.d2sec.com