This message was deleted.

Here are some generic methods of breaking out of locked down environments https://www.pentestpartners.com/security-blog/breaking-out-of-citrix-and-other-restricted-desktop-environments

Most of it is simply on the Windows level. However there are isolated Citrix-specific bits of low-hanging fruit (such as file transfer via the HTML5 client, for instance), that you might want to consider.

you can use this to check your netscaler. if not an a+, there are scripts out there to run on the NS to lock it down, pretty cool --- https://www.ssllabs.com/ssltest/

Anything more for ADC / NSG ?

There have been some known CVEs lately against the gateway, so if the ADC isn’t updated, you might be able to find something. Misconfiguration could also be an issue. Weak TLS settings could maybe lead to something, but doubtful as the ADC overall is fairly secure by default. I would never attack the ADC directly, i would target users or escape the lookdown if you already have valid credentials.