Exploring Terminal Services, the Last 12 Month of Research
Ian Vitek details ian Vitek, Exploring Terminal Services, The Last 12 Month of Research.
Summary
Architecture and Background
Ian Vitek, Exploring Terminal Services, The Last 12 Month of Research. Or, The Evil Admin And His Tools got shell? On a Citrix or Terminal Services server?
Vulnerability Analysis
The speech will demonstrate some common ways to explore Terminal Services. Uploading files with the keyboard and elevate luser rights to SYSTEM. How secure is it for a client to connect to a Citrix or a Terminal Services server if an evil admin owns the box?
Exploitation and Demonstrations
Tools and exploits will be released. Ian Vitek: 183 cm. 80 Kg.
Remediation and Defensive Strategies
Brown eyes. Brown hair. Eats meat. Drinks almost every beer you buy him. Interested in layer 2 network security (writer of macof). If you approach Ian he probably wants to talk about privilege escalation or web application security.
Related talks
Main Stage·50 min
Lior Shmueli · Tomer Peled
Exposes UI redressing and clickjacking vectors in popular browser extensions that trick users into granting administrative cloud permissions with a single click.
Main Stage·40 min
Julian Horoszkiewicz
Demonstrates rapid vulnerability discovery methodologies that uncovered seven zero-day local privilege escalation flaws in pre-installed OEM bloatware.
Main Stage·38 min
Zhengyu Liu · Jianjia Yu
Introduces Hulk, the first dynamic analysis tool to automatically detect and generate exploit payloads for complex DOM Clobbering vulnerabilities at web scale.