Gaining access to Citrix Studio if you don’t already have access

I am proud of this one. Spent a lot of time working my way through this even though I don’t know much SQL and finally cracked it. Probably not a big deal for any “experts” out there but this pretty much was the highlight of my day. :)

A colleague of mine setup a new Citrix site and went for holiday, without giving the rest of us admin access to the site. As expected we needed to access it and while we were waiting for him to get in touch to our messages I thought there must be a way to hack into the system. There is a database behind the scene after all, so if I could just get access to that then maybe I can give myself admin access.

Turns out there is.

We had gone with SQL Express with both delivery controller and SQL server on the same machine, and thanks to this Citrix support article I learnt that in such a case the ‘NT AUTHORITY\NETWORK SERVICE’ account is used to login to the SQL server (that article is a good read for other scenarios too BTW). Cool. I knew I could run something as ‘NT AUTHORITY\NETWORK SERVICE’ using SysInternals PSTools. So I downloaded PSTools to that server, opened a command prompt as admin, and ran the following:

psexec -i -u "nt authority\network service" cmd.exe

1	psexec -i -u "nt authority\network service" cmd.exe

All good so far. Next I downloaded SQL Studio and ran that from the above command prompt. Just type "C:\Program Files (x86)\Microsoft SQL Server Management Studio 18\Common7\IDE\Ssms.exe" into the command prompt window. That will give you the login prompt and you can connect (if it asks for any details the server name is “<your server name>\SQLEXPRESS” and authentication is “Windows Authentication”). This worked and I was in! Yay.

Snooping around the various SQL tables I came across [DAS].[Administrators] which looked like it could contain the administrators. Did a right click > “Select Top 1000 Rows” (remember I am no SQL guru) and that opened a new query which I executed … and sure enough I could see the sole admin account of my colleague who’s on holiday. Nice! Seems to be a list of SIDs followed by a UserIdentityType column of value 0 and Enabled column of value 1. Hmm, maybe I can just add to this table and be done with it? Did a bit of Googling on how to insert into a table, found my SID from psgetsid of the PSTools I had already downloaded, and tried the following:

USE [<replace with your Citrix DB ending with Site>]
GO

INSERT into DAS.Administrators (Sid, Enabled) VALUES ('<put the SID value>',1)

USE [<replace with your Citrix DB ending with Site>]

INSERT into DAS.Administrators (Sid, Enabled) VALUES ('<put the SID value>',1)

And … that didn’t work! Got the following error: “The INSERT permission was denied on the object ‘Administrators’, database …”

Oh well, worth a shot. I looked around the user accounts on the SQL server and the roles and permissions for the network service account and from what I could see it has all the rights it needs. There’s no other account. So surely that’s what the Delivery Controller too is using to add new admins etc. Time to read more.

Back to the Citrix support article I came across earlier, I found the same roles that I had found on the SQL server and also this bit: “Each one of the preceding roles has the minimum permissions granted to it to allow the corresponding service on the controller to function. These permissions are restricted to execute on stored procedures and read on some tables.” Ah ha! So it has permissions to only execute stored procedures and that’s obviously how it is adding admins. Cool!

Obviously I have no idea what a stored procedure is, so time to Google again on how to get to that. Did that, and found a ton of them them under Programmability > Stored Procedures. The table was called “DAS” something so upon a hunch I looked around any procedures starting with “DAS” (not entirely a hunch, I noticed that the procedures seemed to start with similar names as the tables so I made a guess that probably the stored procedures for the “DAS” tables would start with the same name). That paid off and I found “DAS.NewAdministrator”. Cool!

Note to anyone else: to see a stored procedure you right click and do “Modify”. That shows you the code. You can run it via right click > “Execute Stored Procedure” which will give a popup to enter the parameters for the procedure. This part stumped me for a while. I entered the parameters as best as I could figure but it kept throwing various errors. That’s when I spent some time looking at the procedure code and cracked the problem. Once you enter the parameters SQL Studio generates a query which you execute, and that was giving errors. I figured the issue and modified the query. It looks like the below in case anyone else wants to copy-paste and modify:

USE [<put the database name>]
GO

DECLARE @return_value int,
        @IdOfNewObject DAS.UserIdentity

EXEC    @return_value = [DAS].[NewAdministrator]
        @Name = '<admin account user id>',
        @Sid = '<put the SID value>',
        @UserIdentityType = 0,
        @Enabled = 1,
        @IdOfNewObject = @IdOfNewObject OUTPUT

SELECT  @IdOfNewObject as N'@IdOfNewObject'

SELECT  'Return Value' = @return_value

GO

USE [<put the database name>]

DECLARE @return_value int,

@IdOfNewObject DAS.UserIdentity

EXEC @return_value = [DAS].[NewAdministrator]

@Name = '<admin account user id>',

@Sid = '<put the SID value>',

@UserIdentityType = 0,

@Enabled = 1,

@IdOfNewObject = @IdOfNewObject OUTPUT

SELECT @IdOfNewObject as N'@IdOfNewObject'

SELECT 'Return Value' = @return_value

And that worked! Whoo hoo. Still can’t access via Studio, but I double checked the [DAS].[Administrators] table and my account was there.

Hmm, maybe the issue is that I have added myself as an admin but I haven’t granted myself any rights. Remember when you do this via the Studio you have to select a scope and also what rights you want to assign? Probably got to do that via SQL! Not a problem, back to Google. :)

I came across another Citrix article (why didn’t I just find this the first time!? it tackles pretty much what I am doing here. anyways, the first few steps of that article are incorrect as that’s what I too had tried and it didn’t work for me … so good I didn’t stumble upon this initially). This one showed me how to give my admin account rights and scope. Here’s the additional SQL you need to run:

USE [<put your DB name here>]

GO
DECLARE    @return_value int

EXEC    @return_value = [DAS].[AddRight]
@Admin = '<put the SID value here>',
@Role = 'DF20D111-4D0B-4502-AD12-5E8B3AFC62A1',
@Scope = '00000000-0000-0000-0000-000000000000'
SELECT    'Return Value' = @return_value

GO

USE [<put your DB name here>]

DECLARE @return_value int

EXEC @return_value = [DAS].[AddRight]

@Admin = '<put the SID value here>',

@Role = 'DF20D111-4D0B-4502-AD12-5E8B3AFC62A1',

@Scope = '00000000-0000-0000-0000-000000000000'

SELECT 'Return Value' = @return_value

No rocket science here. It uses another stored procedure called “DAS.AddRight” to give my SID “Full Administrator” rights to the scope of “All Objects”. That completed without any errors, so I closed and opened Citrix Studio and yay I am now in!

And that, ladies and gentlemen is how you get into Citrix Studio if you don’t already have access! :)