{"id":114,"date":"2015-05-30T15:50:29","date_gmt":"2015-05-30T14:50:29","guid":{"rendered":"http:\/\/kolbi.cz\/blog\/?p=114"},"modified":"2017-12-15T17:05:44","modified_gmt":"2017-12-15T16:05:44","slug":"netscaler-endpoint-analyse-epa-pre-authentication-bypassing","status":"publish","type":"post","link":"https:\/\/kolbi.cz\/blog\/2015\/05\/30\/netscaler-endpoint-analyse-epa-pre-authentication-bypassing\/","title":{"rendered":"Netscaler Endpoint Analyse (EPA) Pre-Authentication bypassing!"},"content":{"rendered":"

UPDATE:<\/strong> bypassing the EPA scan with this method is only possible when using the Netscaler default settings. read the update at the end of this article, which explains\u00a0how to enable encryption for the client security expressions.<\/em><\/p>\n

Citrix Netscaler Gateway offers the ability to scan client computers and check\u00a0certain requirements. these include\u00a0operating system, ports, registry, antivirus, files and a many more items.<\/p>\n

these scans can take place even before a user logs in and we can control who actually is able to\u00a0see the login page\u00a0at all.\u00a0if a\u00a0scan fails, the user gets redirected to an error page and can then run the scan again. with this feature, we can check if a computer is a business device or a home computer and for example block all private devices.<\/p>\n

first i need to say that remote client security is very difficult to control, because an administrator of a machine can virtually do anything he wants. this includes debugging of running code, analyzing and manipulating network packets and intercepting http requests. an endpoint analyse software can therefore be analyzed, monitored, modified and tricked to send back wrong results.<\/p>\n

just out of curiosity i have analyzed the Netscaler EPA scan and tried to bypass it. this turned out to be very easy and im somewhat surprised, that it is\u00a0implemented in such a\u00a0weak way. actually i have found a very simple\u00a0backdoor and also some unwanted information leaking – an attacker can easy find out, which components must be present on an\u00a0endpoint to pass the scan.<\/p>\n

just for proof of concept, i have also used sysinternals procmon<\/a> and i was able to find the registry and filechecks pretty easy – this is why i said, client security is difficult to control – these checks cant be really hidden on the endpoint and will\u00a0always be revealed rather\u00a0quickly.<\/p>\n

but even if a company decides to add 100 checks for files, antivirus, registry keys, domain membership etc, etc – my\u00a0discovered backdoor will allow a quick access to the login page and tricks\u00a0the EPA scan.<\/p>\n

first, let me explain how the EPA scan in detail works:<\/p>\n

\"epa_scan\"<\/a><\/p>\n

i discovered this by using OWASP ZAP Proxy<\/a>\u00a0while\u00a0analyzing the http requests. by doing so, i have found\u00a0something\u00a0very\u00a0interesting. when the epa client connects to the \/epaq to load the items for local execution, the configuration is transfered IN CLEARTEXT<\/strong>!!! this means, we can very quickly find out, which items the EPA scan actually checks on the endpoint. but\u00a0this is information, that an attacker shouldnt get that easy!<\/strong> check here the screenshot from ZAP:<\/p>\n

\"zap_config\"<\/a><\/p>\n

this is exactly what i have configured in my netscaler EPA Pre-authentication policy! a domain check for “mydomain.local” and the file “c:\\securefile.bin” – ouch! sure, the connection from the client to the Netscaler is SSL protected, but with a local proxy, we can intercept this traffic and analyze it.<\/p>\n

but it gets actually even worse – after that checks, the EPA client sends the result back to the Netscaler – and by results i mean just a result code<\/strong>!<\/p>\n

\"epa_code\"<\/a><\/p>\n

i analyzed a successful EPA scan and the\u00a0code just changed to 00 – now guess what we can do here? yeah… with ZAP we can set a breakpoint on the \/epas url and then simply change the resultcode – this will completely override\u00a0the EPA scan result and we can get the login page with a non compliant machine!<\/strong><\/p>\n

the question is, can we even trick the EPA scan without<\/em> ZAP? yes we can – with a simple Firefox addon called Modify Headers<\/a>!<\/p>\n

\"modifyheaders\"<\/a><\/p>\n

just install the addon in firefox and add the custom header “CSEC” with the value “00” to it. now\u00a0we can recreate\u00a0the process\u00a0explained on\u00a0first image with our browser – but because it needs the cookies that Netscaler sends in the first request, we cannot simply surf to the \/vpn page directly. here is how you can do it,\u00a0if you dont want to use ZAP – just dont forget the Modify Header plugin and to set\u00a0“CSEC=00”.<\/p>\n

    \n
  1. open the root page from the Netscaler Gateway and let it redirect to \/epa\/epa.html<\/li>\n
  2. the EPA client will launch\u00a0– dont close it!<\/li>\n
  3. now surf to the same site but change the url to \/epatype – it will display “Epa:on;deviceCert:off;”<\/li>\n
  4. change the url manually again to \/epaq – an empty page will appear.<\/li>\n
  5. put \/epas in your browser and it will display “10”<\/li>\n
  6. now surf to the main site or add \/vpn\/index.html to the location bar<\/li>\n
  7. done. you are able login with your credentials now, even if the computer didnt pass the EPA scan!<\/li>\n<\/ol>\n

    it does not really matter, what the EPA client scans on the machine – the custom header must match “00” and all is fine! not so good \ud83d\ude41<\/strong><\/p>\n

    how could this be improved then?<\/p>\n