HACKIN G CITRIX

Citrix Presentation Server 4.5 New version is called XenApp/Server Common Deployments Nfuse classic CSG – Citrix Secure Gateway Citrix Components Server farm Citrix XML service ICA client device Nfuse Web server STA – Secure Ticketing Authority

NFuse Classic Different Interfaces Browser accessible http://server/Citrix/AccessPlatform/auth/login.aspx Program neighbourhood http://server/Citrix/PNAgent/config.xml Gateway for Citrix Conferencing Manager http://server/Citrix/cmguest

NFuse Network NFuse Displays Application List NFuse Sends Credentials To XML Service To Validate If Valid, XML Service Retrieves Application List From Farm Browser Enters Credentials Into NFuse Web Page User Selects Application And Receives An ICA File ICA Client Loads ICA File And Connects To Citrix Farm ICA Client Device ICA Client Doesn’t NEED NFuse To Connect To Server Farm Browser ICA Client

NFuse Network Common Basic Deployment For Remote Network Application Exposure XML Service Can Sit On The Nfuse Server XML Service Can Sit On One Of The App Servers XML Service Can Sit On Independent Web Server Holes In Firewall Please ICA Client Device Browser ICA Client

Citrix Secure Gateway ICA Client Device Browser ICA Client User Selects Application And NFuse Requests Ticket From STA If Valid, XML Service Retrieves Application List From Farm CSG Verifies Ticket Against STA NFuse Sends Credentials To XML Service To Validate Ticket Returned To Browser As Part Of ICA File If Verified Then Access Is Provided To Server Farm More Secure As Server Farm Not Exposed. Firewalls In Between Segments ICA Client Connects To CSG (SSL) And Sends Ticket Browser Enters Credentials Into NFuse Web Page ICA File And Ticket Format Explained Later

HTTP Traffic Between Browser And Nfuse Places To Sniff USE HTTPS Cleartext credentials posted to login form Web Cookie ICA file returned from NFuse HTTP Traffic Between Browser And Nfuse ICA Client Device Browser ICA Client

HTTP Traffic Between NFuse And XML Service Places To Sniff a -> M E G B b -> M H G C c -> M G G D d -> M B G E e -> M A G F f -> M D G G g -> M C G H h -> M N G I i -> M M G J j -> M P G K k -> M O G L l -> M J G M m -> M I G N n -> M L G O o -> M K G P USE HTTPS USE SSLRelay HTTP Traffic Between NFuse And XML Service Cleartext XML contains ‘encoded’ credentials Password t N B H E te N B H E L E B B tes N B H E L E B B M H G C test N B H E L E B B M H G C L D B G In deployments that do not support running the SSL Relay, run the NFuse Web server on your Citrix server

ICA Traffic From Client Or CSG Places To Sniff ICA protocol is not encrypted by default USE SecureICA USE SSL/TLS USE SSLRelay ICA Traffic From Client Or CSG ICA Client Device Browser ICA Client

Connection Data Between ICA Client And Server .ini type layout ICA File Format Connection Data Between ICA Client And Server .ini type layout Doesn’t contain clear text credentials [ApplicationServers] Calc= [Calc] Address = 192.168.237.101:1494 BrowserProtocol = HTTPonTCP ClearPassword = 0674F0F9BD3B0D Domain = \DB247117DF8EC22A InitialProgram = #calc SSLProxyHost = CSG Address Username = Whoami

Apparently it has an expiry time Ticketing Nfuse Ticket Apparently it has an expiry time XOR credentials and send to XML server Get Ticket in response Split ticket prepend \ and place into domain:password STA Ticketing Is not server authentication Places ticket in the address field of .ica file 40;STA47;AFA4ABD7741BB4306079BAC6AB2BDAF4 If I can talk to the STA server I can create STA tickets Uses pseudo-random number generation to produce a 16-byte hex string. For security reasons, Citrix does not disclose the exact steps used to produce this random sequence of characters UNIQUE TICKET STA MACHINE ONLY ALLOW CONNECTIONS FROM TRUSTED MACHINES

Shadowing Allows Snooping On Other Sessions On by default Prompts user

Controls access to the Web Application Authentication NFuse Web Application Controls access to the Web Application

Published application setting Authentication Citrix Server Farm Published application setting Controls access to the application

Password set on each use Anonymous Access Easy to use Anonymous Accounts Anon001 – Anon014 Created upon install Password set on each use Anonymous Access Easy to use Used for ‘temporary’ application use

Installed By Default On Port 80 ISAPI extension under IIS Citrix XML Service Installed By Default On Port 80 ISAPI extension under IIS Can be set for different port Sensitive Operations Require Auth Unless turned off for smartcard passthru Used by Nfuse and PNAgent Validate Credentials STA Requests Server Enumeration

Brute force the NFuse login page Brute Force ICA File Gaining Access Brute Force Web Page Brute force the NFuse login page Brute Force ICA File Will attempt to connect to Citrix application server ActiveX and API makes this easy Ask The IMA Service Sits on UDP port 1604 Unauthenticated requests will respond with application list Ask The XML Service By default sits on TCP port 80 If you ask politely it tell you

Anonymous vs Standard Internal User Breaking The Citrix Sandbox Demonstration Gaining Access Anonymous vs Standard Internal User Breaking The Citrix Sandbox Weak security settings Uploading Tools Alternative file transfer methods Privilege Escalation Third party or windows vulnerability Token Theft Full domain control

No Citrix Vulnerability Exploited Weak / default configuration Recap No Citrix Vulnerability Exploited Weak / default configuration Anonymous Application Access Was only part of the issue Pretty Common Scenario Most citrix reviews involve gaining ‘shell’ access

Enabled ‘run only published applications’ Securing Lockdown Citrix Disable file sharing Enabled ‘run only published applications’ Turn on encryption and use SSL Lockdown OS Use group policy to enforce restrictions Disable the runas service Lockdown File System Restrict users access to directories and commands Understand The Weaknesses Hopefully this demonstration has helped

www.insomniasec.com