Talk delivered by Chema Alonso and Juan Garrido "Silverhack" in Defcon 19 about new tricks for hacking Citrix and Terminal Services environments using Excel (and Office Apps) to run commands in the server.

1. Bosseslove Excel …hackers too! Juan Garrido “Silverhack” Chema Alonso (@chemaalonso) INFORMATICA64.COM

2. Who?

3. About Working at INFORMATICA64.COM http://www.informatica64.com

4. What?

5. Terminal Applications

6. Why?

7. RDP

8. Citrix

9. Using Bing

10. GovermentSites

11. GovermentSites

12. Secure?

14. Verbosity Conf -files are tooverbosity Internal IP Address Users & encryptedpasswords Internal Software PerfectforAPTs 0-day exploits Evilgradeattacks

15. Verbosity

16. Verbosity Attacker can: modifyconf files Generate error messages Fingerprintingall software Example: C.A.C.A.

17. Terminal Services Remoteapplicationmode 0 -> Desktop 1 -> Only App Whatapp? Alternate Shell (RDP < v 6.0) RempoteApplicationProgram (RDP v 6.0++)

18. Terminal ServicesError Messages

19. ComputerAssited Citrix Apps

20. Playingthe Piano

21. Playingthe Piano Toomany links SpeciallyrunningonWindows 2008 Toomanyenvironment variables %SystemRoot% %ProgramFiles% %SystemDrive%

22. Window Server 2008 wantstohelpyou!! (anytime!)

23. Playingthe Piano Toomanyshortcuts Ctrl + h – Web History Ctrl + n – New Web Browser Shift + LeftClick – New Web Browser Ctrl + o – Internet Addres Ctrl + p – Print RightClick (Shift + F10) SaveImage As View Source F1 – Jumpto URL…

24. Playingthe Piano Too , Too, Toomanyshorcuts: ALT GR+SUPR = CTRL + ALT + SUP CTRL + F1 = CTRL + ALT + SUP CTRL + F3 = TASK MANAGER StickyKeys

25. Easy?

26. Demo Servers

27. Paths?

28. MinimunExposurePaths There are as manypaths as pulbishedapps Everyappis a paththatcould drive toelevateprivileges Complextools are bettercandidates Excel is a complextool

29. Bosseslove EXCEL

30. VBA

31. Excel 1:Thepower of VBA

32. Software RestrictionPolicies Toomanyconsoles Cmd.exe Windows Management Instrumentation PowerShell Jscript Cscript.. ….

33. Software RestrictionPolicies Forbiddenapps Via hash Viapath App Locker Using Digital Certificates ACLs

34. Software RestrictionPolicies Toomanyconsoles, (EvenfrOmother OS) Reactos….

35. Excel 2forbiddenConsoles

36. Security Policesfor Excel Macros Disable VBA - Securebutit´snot REAL Excel 2) Security for macros - No macros - signed macros - Case by case - All macros

37. Excel 3No macros!

39. Excel 4OnlySigned-macros

40. Risky?

41. Startthe III WorldWar Find a bug in a DHS Computer Trust in yourRogue CA Generateanattacking URL in the CRL (attacking China, forexample) Signanexcel file withyourrogue CA Send a digital ly-signedexcel file tosomeonerelevant!

42. Somethinglike…

43. Justkidding

44. Solutions Re-evaluateyourRemote App connections No alerts at all in Excel (and alltherest of appsyoupublish) No trustedlocations in user-profiles No sharedremoteusers Trust in nobodoy… Sorry, noteven in nobody

45. Howmaypaths do youhave? TS Web Access Hiddenmeansnot-removed

46. Contactinformation Juan Garrido “Silverhack” jgarrido@informatica64.com http://windowstips.wordpress.com Chema Alonso chema@informatica64.com http://www.elladodelmal.com @chemaalonso http://www.informatica64.com

47. SpecialThanksto Didier Stevens http://blog.didierstevens.com/2010/02/04/cmd-dll/ ShanitGupta http://www.blackhat.com/presentations/bh-usa-08/Gupta/BH_US_08_Gupta_Got_Citrix_Hack_IT.pdf PDP http://www.blackhat.com/presentations/bh-europe-08/Petkov/Presentation/bh-eu-08-petkov.pdf

48. ?