bugtraq - Re: Remote Desktop Command Fixation Attacks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 10 Oct 2007 15:38:08 -0400
From: Steve Shockley <steve.shockley@...ckley.net>
To: bugtraq@...urityfocus.com
Subject: Re: Remote Desktop Command Fixation Attacks

pdp (architect) wrote:
> The attack is rather simple. All the bad guys have to do is to compose
> a malicious RDP (for Windows Terminal Services) or ICA (for CITRIX)
> file and send it to the victim. The victim is persuaded to open the
> file by double clicking on it. When the connection is established, the
> user will enter their credentials to login and as such let the hackers
> in. Vicious!

So, "all you have to do" is persuade the user to run an attachment and 
type in credentials.  Wouldn't it be simpler to just email the user a 
batch file and have them run it?  Why not just use the same message from 
"Tim from Tech Department" and substitute a web page for the RDP file?

It's not clear from your article, but I assume you're having the user 
connect to their normal Citrix or TS farm to run the program.  First, 
why in the world would you give users administrative rights on your 
servers?  Secondly, why wouldn't you use software restriction policies 
to whitelist only allowed apps on your server?

 > I will show you how easy it is to compromise a well protected Windows 
Terminal or CITRIX server

No, you showed how to compromise a poorly-configured TS or Citrix server.

 > Security in depth does not exist!

Sounds more like shallow configurations.