How To Upload Documents In Tcs Citrix

During a recent engagement I was asked to perform a penetration test of a Citrix environment. 1 detail requirement of this test was to encounter whether I could transfer files back and forth betwixt my local reckoner and the remote environment.

The easiest way to transfer information was through their web proxy. Although it implemented some sort of web filtering, Internet access was immune. I encrypted a document in a null file and then uploaded information technology to a web server controlled past Dionach. This allowed me to bypass the filters and attain the goal.

Even so, the client requested if information technology was possible to achieve the same result but not using Internet Explorer. I explained them that another manner was via Outlook. Past attaching the encrypted document in an email it was possible to transfer the file to an attacker'due south email address.

Non entirely convinced, the client asked me if in that location was some other method in case inside Citrix environment Internet admission was completely denied.

I started messing around with Citrix preferences and settings. When you connect to the remote machine via Citrix on top of the Desktop Viewer there some configurations settings, simply unfortunately it didn't permit me go very far.

Copy and Paste was disabled and I could not drag and drop files. Nonetheless, eventually I came upwards with this solution which immune me to transfer files quite easily via USB redirection. The steps are:

one) Connect a USB drive to the local machine.

2) Open "Connectedness Center" by right-clinking the Citrix icon in the Notification Area on bottom right of the Windows taskbar.

3) Click "Connection Heart" under Advanced tab.

4) Inside "Connection Center" expands all the options. In my case I had the option to launch an case of Microsoft OneNote 2010 by double clicking on the icon.

v) Inside Microsoft OneNote, go to "open" and then "scan".

vi) At this phase it is now possible to access the local USB bulldoze within the Citrix environs.

7) Using copy and paste functionality, I copied the Exam.txt file to the Desktop of the Citrix environment.

eight) The TEST.txt file is therefore bachelor on the Desktop of the Citrix environment.

9) The same process can be used to copy files from the Citrix environment to the local computer.

In this particular example Citrix allowed me to map local USB drives, highlighting a poor configuration of Citrix. The post-obit manufactures provide further data on how to enable and disable USB redirection.

https://support.citrix.com/article/CTX137939
https://support.citrix.com/proddocs/topic/xenapp-xendesktop-76/xad-hdx-usb-cdm.html

Dionach recommend that Citrix environments are regularly tested in lodge to discover vulnerabilities which tin can exist used by attackers such as a rogue employee. Every bit it happened in this example, past breaking out of the Citrix surround, information technology allowed the Dionach consultant to accept a foothold in the internal network and eventually to compromise the entire domain.