Citrix and Terminal Services
Ian Vitek - Citrix and Terminal Services Citrix and Terminal Services are becoming very popular.
Summary
Architecture and Background
Ian Vitek - Citrix and Terminal Services Citrix and Terminal Services are becoming very popular. Ian Vitek will speak about: # Scanning and finding Terminal Services and Published Applications. This will include statistics of open and vulnerable servers.
Vulnerability Analysis
# Connection to Published Applications. This can be harder than you think. Most of the servers have Published Applications.
Exploitation and Demonstrations
You can't just see them. # Breaking out from the given environment and elevation of rights. # Demonstration.
Remediation and Defensive Strategies
The way administrators set up their Citrix servers every so often the Citrix client can't enumerate Published Applications or connect to them from Internet. Tools for enumerating and connecting to Published Applications will be released. Ian Vitek has been working for iXsecurity in Sweden as a Penetration Tester for seven years. He is more a networking guy then doing assembly stuff. He is the writer of macof and briiis.
Related talks
Main Stage·43 min
Quentin Roland · Wilfried Bécard
Demonstrates how red teams can weaponize Active Directory Group Policy Objects (GPOs) into a stealthy, native command-and-control infrastructure.
Main Stage·34 min
Yuval Gordon
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.
Main Stage·39 min
Mehdi Elyassa
Explores new offensive attack paths and privilege escalation techniques targeting Microsoft System Center Configuration Manager (MECM/SCCM) in enterprise networks.