Hacking Citrix and Terminal Server Techniques

From time to time we are asked by friends for assisting hacking Citrix, Jetro CockPit, Terminal Servers and machine hardening.
So we decided to write a list of our hacking techniques that we use in case someone tries to close some registry keys ;-)

We will try regularly update this list:


Basic shortcuts:

• Open file: Ctrl + o
• Save File: Ctrl + s
• Open New Browser: Ctrl + n, Shift (or Ctrl) + Left Click on link
• Browser History: Ctrl + h
• Task Manager: Ctrl+Shift+Esc
• File manager: Windows + E
• Run commands: Windows + R
• Utility Manager: Windows + U
• Windows search: Windows + F

Open Internet browser:

• Press F1 – Click on any URL to open.
• Click on help on the language bar.
• Windows + U -> Help
• Run calc -> Help -> Help Topics -> Mouse right click on the window blue frame -> Jump to URL

Get local files (like cmd.exe):

• Printing window (Ctrl + p) -> print to file -> filename=* -> Enter -> and browse to system32
• Right Mouse Click (or Shift + F10) -> Save Picture As -> filename=* ->…
• View Source -> filename=* ->…
  

If the right mouse click is forbidden:

• Use Shift + F10

Run Command Shell:

• Run command.com
• Drag other file on cmd.exe or command.com
• Shortcut to cmd.exe or command.com
• Batch file with: c:\windows\system32\cmd /c (Or /K) any_command
• VBS script:
Dim shlomi ShellSet shlomiShell= WScript.CreateObject ("WScript.shell") oShell.run "cmd /K CD C:\ & Dir" Set shlomiShell= Nothing

Open file manager using IE:

• Favorites -> Drag any folder to browser’s window.

Using office applications:

• Insert Picture -> filename=* ->…
• Insert Hyper Link - > file://c:\windows\system32\cmd.exe
• Insert object -> Create from File -> cmd.exe or command.com
• Run VB (or VB Macro).

If you can't run shell:

• Rename cmd.exe (or command.com) to applicationName_uCanRun.exe.
  
• Use Debug.exe, using this you can run almost any exe you like. You just need to upload the Assembly code or write by yourself.
• Run VB compiler, using office applications.