What we are going to talk about? New tool released at Blackhat - - PowerPoint PPT Presentation

▶
what we are going to talk about
SMART_READER_LITE
LIVE PREVIEW

What we are going to talk about? New tool released at Blackhat - - PowerPoint PPT Presentation

Nov 28, 2022 421 likes •804 views

What we are going to talk about? New tool released at Blackhat Canape What is Citrix ICA? In Canape: MitM ICA Fuzz ICA Exploit ICA 0 Day What is Canape? Binary Network Application Testing Tool Existing

slide-1
SLIDE 1
slide-2
SLIDE 2

What we are going to talk about?

  • New tool released at Blackhat –

Canape

  • What is Citrix ICA?
  • In Canape:

– MitM ICA – Fuzz ICA – Exploit ICA

  • 0 Day
slide-3
SLIDE 3

What is Canape?

  • Binary Network Application Testing Tool
  • Existing tools:

– HTTP proxies (e.g. CAT) – Echo Mirage – Python libraries – Custom code – Wireshark

  • Why a new tool?

– Has these features and more – All driven through a GUI

  • And it’s free!
slide-4
SLIDE 4

How does it MitM?

  • MitM support:

– SOCKS – Port forwarding – TCP, UDP, HTTP, Broadcast – SSL

  • Pipelines
slide-5
SLIDE 5

What is ICA?

  • Protocol used for Citrix XenApp and

XenDesktop products

  • Remote desktop and applications
  • Uses a bespoke client
  • Needs a suitable configuration file to

connect

slide-6
SLIDE 6

Citrix Web Interface

slide-7
SLIDE 7

The ICA File

[WFClient] Version=2 TcpBrowserAddress=10.0.131.190 [ApplicationServers] 10.0.131.190= [10.0.131.190] Address=10.0.131.190 InitialProgram= ICASOCKSProtocolVersion=0 ICASOCKSProxyHost=127.0.0.1 ICASOCKSProxyPortNumber=1080

slide-8
SLIDE 8
  • MitM ICA traffic

Demo 1

slide-9
SLIDE 9

ICA Protocol

  • Stream based protocol
  • Single TCP stream
  • Phases

– Hello – Negotiation – Main stream

  • Encrypted
  • Compressed
  • Multiplexed
slide-10
SLIDE 10
  • Handling state

transitions

Demo 2

slide-11
SLIDE 11

ICA Main Protocol

  • Main protocol is wrapped in a simple

frame

  • 12 bit byte length
  • 4 bit flags
slide-12
SLIDE 12
  • Parsing the framing

Demo 3

slide-13
SLIDE 13

Basic ‘Encryption’

slide-14
SLIDE 14

The ‘Encryption’

slide-15
SLIDE 15

Encryption Diagram

KEY | 0x43 X1 X0 X2 X3 P1 P0 P2 P3 Key

slide-16
SLIDE 16
  • MitM the encrypted

XOR stream

Demo 4

slide-17
SLIDE 17

Compression

  • Registry key

– HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\ICA Client\Engine\Configuration\Advanced\Modules \TCP/IP\Compress = Off

slide-18
SLIDE 18
  • Downgrade to no

compression

  • Replace:

– 0x00 0x10 0x12 => 0x00 0x00 0x00

Demo 5

slide-19
SLIDE 19

Key Press

0x0a 0x1e 0x04 0xfe 0x0a 0x9e 0x04 0xfe

A

Type Scan Code End Marker ?

slide-20
SLIDE 20

Mouse Movement

0x0d 0x2acd 0x1fa7 0xfe

Type X Coordinate ? End Marker Y Coordinate

0x01 0x0C

Button State Button State 01 – No Buttons 02 – Press Left 04 – Release left 08 – Press Right 10 – Release Right

slide-21
SLIDE 21

Fuzzing

  • Standard fuzzing

– But we are in the encrypted and compressed stream

  • Byte fuzzing
slide-22
SLIDE 22
  • Fuzz the contents of

the encrypted stream

Demo 6

slide-23
SLIDE 23
slide-24
SLIDE 24

Example Citrix ICA Client Bug

  • Old, reported February 2008
  • Fixed August 2010
  • Affected clients on:

– Windows – Mac – Linux – Solaris – Windows Mobile

  • Demo on Windows XP SP2

http://support.citrix.com/article/CTX125975

slide-25
SLIDE 25
slide-26
SLIDE 26

We Control

slide-27
SLIDE 27

Value: EAX Value: YYYY Value: XXXX

Offset Value

Control Offset: AAAA 0: Offset1 1: Offset2 2: Offset3 AAAA 0: Offset1 1: Offset2 2: Offset3 XXXX 0: Func1 1: Func2 2: Func3 YYYY CALL EAX

slide-28
SLIDE 28
  • Brute force the value

to find a heap offset

Demo 7

slide-29
SLIDE 29

Heap Spray

Heap call eax Heap Spray

Used Memory 000000000 NOP Shell Code 000000000 NOP Shell Code 000000000 NOP Shell Code 000000000

Header Header Header

slide-30
SLIDE 30

Easy Heap Spray

Packet Buffer LEN LEN TYPE DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA DATA LONG LEN DATA DATA DATA DATA DATA DATA Packet Copied

slide-31
SLIDE 31

Heap Header

0000 => ADD BYTE PTR [EAX],AL

Size Prev Size Cookie Flags

Unused

Segment Index

0 2 4 5 6 7 8 Control Heap Spray Size

81 00 => ADD DWORD PTR DS:[EAX], PrevSize_Cookie_Flags

Random Valid Pointer

slide-32
SLIDE 32

Exec Heap Header

EAX pointer to valid memory Our NOP Sled and Shellcode

slide-33
SLIDE 33
  • HTTP send ICA file
  • Replay negotiation
  • Prime the heap –

large packet

  • Spray the heap x 5000

– small packet big Len

  • Send payload trigger

packet

Demo 8 "Root"

slide-34
SLIDE 34
  • The Power of

Canape!

Demo 9 "Other Examples"

slide-35
SLIDE 35
  • Demo only, sorry 

Demo 10 "0Day"

slide-36
SLIDE 36

Questions

  • Please fill in your feedback forms
slide-37
SLIDE 37

References

  • http://canape.contextis.com
  • Twitter: @ctxis
  • Email: canape@contextis.com