Citrix Workspace - Virtual Desktop (VDI-WIN10-SEC04)

Citrix Workspace 🖥️ CONNECTING...

Burp Suite Professional

Google Chrome

Report_v1.0.docx

Task Manager

Scope Notes.txt

Command Prompt

Pentest Notebook

Recycle Bin

Burp Suite Professional v2024.3 - Temporary Project (4 vCPUs / 16GB RAM)

Burp Project Target Proxy Intruder Repeater Window Help

Dashboard

Target

Proxy

Repeater

Intruder

Decoder

Extender

Tab 1*

Request [Raw] Select or type text to feel VDI lag

Response [Raw] -- millis

⚡ Issue Activity (342 issues found during passive & active scan)

🔴 18 High 🟠 47 Medium 🔵 122 Low ⚪ 155 Info

#	Sev	Issue Type	Path / URL	Confidence

📋

Click any of the 342 findings on the left to inspect issue details & advisory.

⚡ 342 issues found

Proxy: Intercept is off | Target Scope: 1 rule

Heap: 15,240M / 16,384M (93%)

Google Chrome - Target Internal Portal

🔒 ClientCorp Internal Admin ✕

Enterprise Identity Management Portal

Internal restricted system. Penetration testing in progress. All actions logged to SIEM.

Privilege Escalation Test Form

Target Username or ID: Desired Role:

ClientCorp_Penetration_Test_Report_v1.0.docx - Word

Home

Insert

Layout

References

Review

View

CONFIDENTIAL SECURITY ASSESSMENT REPORT

ClientCorp Cloud Core & Identity Access Management

1. Executive Summary

During the engagement conducted against the ClientCorp internal management portal, multiple high-severity vulnerabilities were identified permitting unauthorized role escalation and arbitrary account modifications.

2. Summary of Findings

Finding ID	Vulnerability Title	Severity	Status
SEC-01	Broken Object Level Authorization in Role Grants	CRITICAL	Confirmed Exploitable
SEC-02	Insecure JWT Verification on Internal API	HIGH	Confirmed Exploitable
SEC-03	Cross-Site Scripting in Tenant Admin Panel	MEDIUM	Verified

3. Remediation Guidance

Enforce strict server-side authorization checks on all role mutation endpoints. Validate signature algorithms on incoming bearer tokens.

Task Manager (4 vCPUs / 16.0 GB RAM)

Processes

Performance

App history

Details

% 4-Core CPU Utilization Over 60 Seconds Intel Xeon Gold 2.50GHz

Process Name	CPU	Memory	Status
java.exe (Burp Suite Pro)	48.2%	8,450.2 MB	Very High Power
chrome.exe (Client Portal)	24.6%	4,820.0 MB	High Power
WINWORD.EXE (Report Editor)	14.2%	1,280.0 MB	Active
ThinwireSvc.exe (Citrix Display Encoder)	21.8%	1,150.4 MB	Software Video Encode
dwm.exe (Desktop Window Manager)	4.1%	680.1 MB	Running

JupyterLab - Pentest_Exploits.ipynb (Python 3.12 Kernel)

🐍 Exploit_Payloads.py

📝 Scope_Notes.md

🔑 Leaked_Hashes.txt

In [1]: (Editable Python Script) Press '▶ Run Cell' to test VDI execution delay

import requests, time

# Automated privilege escalation exploit probe
target_url = "https://portal.clientcorp.local/api/v2/roles/grant"
headers = {"Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.sec"}
payload = {"targetUserId": 9042, "role": "DomainAdmin"}

print(f"[*] Testing payload against {target_url}...")
print(f"[*] Target user: 9042 | Desired role: DomainAdmin")

[Output will appear here when you click "▶ Run Cell" above. Experience network lag and server response delay.]

Markdown Scratchpad Test delayed text selection & backspace buffering

# Penetration Test Execution Plan
Target Scope: portal.clientcorp.local (10.142.12.0/24)

Key Hypotheses:
1. Role assignment API endpoint lacks server-side tenant validation.
2. Broken object level authorization allows ID 9042 to claim DomainAdmin.
3. JWT secret key is weak or vulnerable to algorithm confusion.

Next Steps:
- Extract session cookies from Chrome browser.
- Forward intercepted request to Burp Repeater.
- Format PoC findings in Report_v1.0.docx.

Leaked Hashes & Tokens

admin:$6$rounds=5000$g9qJ8...$1dK9a47... : Cracked -> P@ssw0rd2026!
svc_portal:$6$rounds=5000$h8xP2...$9kL2m11... : In-Progress
jwt_token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMDQyIn0...

📶 ⚠️ 🔊

14:30 9/7/2026

🎮 Presenter Chaos HUD Ctrl+Shift+P

Preset Profile:

Base Latency: 350ms

Open /controls on a 2nd screen or phone