<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;">
I`ve
posted
some
notes
about
this
case
,following
previous
works
on<br> my
blog
few
days
ago
.
Though it may be interesting for some of list members.<br>,feel
free
to
replay
on
list
,or
drop
some
comments
,
specially
about
'attack-1'
. <br><br> Here`s
the
link<br> <a href="http://hkashfi.blogspot.com/2008/03/citrix-terminal-service-and-some-dirty.html" target="_blank"><span class="yshortcuts" id="lw_1204647777_0">http://hkashfi.blogspot.com/2008/03/citrix-terminal-service-and-some-dirty.html</span></a><br><br><br>regards<br>Hamid<br><br><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;">----- Original Message ----<br>From: DSquare Security <info@d2sec.com><br>To: dailydave@lists.immunitysec.com<br>Sent: Wednesday, February 27, 2008 9:47:32 PM<br>Subject: [Dailydave] Owning Citrix & Terminal Services Clients<br><br>
Several
vulnerabilities
can
help
you
to
compromise
a
Citrix
server
or<br>a
Terminal
Services
server.
So
the
question
is:
what
can
you
do
when<br>you
have
a
privileged
access
on
these
Citrix
and
Terminal
Services<br>servers?
The
answer
is
simple:
try
to
compromise
Citrix
and
TS
clients.<br><br>There
are
at
least
two
interesting
ways
to
access
client
data<br>1)
Spying
his
session
to
get
passwords
from
a
published
application<br>2)
Accessing
his
local
drives
if
they
are
mapped
in
the
session<br><br>D2CiTerm
is
designed
to
help
you
in
this
kind
of
work.
Here
are
two<br>demonstrations
of
this
tool:<br><br>1)
>From
a
remote
SYSTEM
access
after
the
exploitation
of
Citrix
MPS
4.0<br>
IMA
Service
Heap
overflow:
<a href="http://www.d2sec.com/d2citerm_1.htm" target="_blank">http://www.d2sec.com/d2citerm_1.htm</a><br><br>2)
>From
a
privileged
Citrix
session:
<a href="http://www.d2sec.com/d2citerm_2.htm" target="_blank">http://www.d2sec.com/d2citerm_2.htm</a><br><br><br>This
tool
will
be
released
in
the
next
update
of
D2
Exploitation
Pack.<br><br><br>-- <br>DSquare
Security,
LLC<br><a href="http://www.d2sec.com" target="_blank">http://www.d2sec.com</a><br><br>_______________________________________________<br>Dailydave
mailing
list<br><a ymailto="mailto:Dailydave@lists.immunitysec.com" href="mailto:Dailydave@lists.immunitysec.com">Dailydave@lists.immunitysec.com</a><br><a href="http://lists.immunitysec.com/mailman/listinfo/dailydave" target="_blank">http://lists.immunitysec.com/mailman/listinfo/dailydave</a><br></div><br></div></div><br>
<hr size=1>Looking for last minute shopping deals? <a href="http://us.rd.yahoo.com/evt=51734/*http://tools.search.yahoo.com/newsearch/category.php?category=shopping">
Find them fast with Yahoo! Search.</a></body></html>