Juniper VPN client rdesktop clickhack

[niekt0 <niekt0@xxxxxxxxxxx>]

Juniper VPN client rdesktop clickhack
================================
discovered by niekt0@xxxxxxxxxxx

PRODUCT: Juniper VPN client + Windows remote desktop (or console access)

VERSION AFFECTED: Win Vista/7 + Juniper VPN client (all versions)

EXPOSURE: Remote code execution (SYSTEM privileges)

SYNOPSIS
========
By simple clicking it is possible to spawn a
Internet Explorer instance on rdesktop session
before authentication.
Account on target server is not required.

PROOF OF CONCEPT
================
If small blue icon "network logon" is available in right down corner,
system may be vulnerable (windows vista & 7).
Click on the icon and keep clicking like a real power user until
you get your explorer.
Probably at least one VPN or Dial-UP connection must be defined.
Illustrated guide is available at
https://hysteria.sk/~niekt0/advisory/rdesktop_fun/

WORKAROUND
==========
None known.

VENDOR RESPONSE
===============
Not contacted. (try calling "helpdesk")

NOTICE
======
It is not really clear, if this is only juniper issue.
After third click, ale spawned screens are legitimate windows menu.
According to some guides it should be possible to create
"network logon" icon just by setting Windows. However,
I was not able to do so, at least not in Windows 7 ultimate.

Thanks to #brmlab, biiter