# Kiosk Escape and Jail Breakout

## Summary

* [Methodology](#methodology)
* [Gaining a command shell](#gaining-a-command-shell)
* [Sticky Keys](#sticky-keys)
* [Dialog Boxes](#dialog-boxes)
    * [Creating new files](#creating-new-files)
    * [Open a new Windows Explorer instance](#open-a-new-windows-explorer-instance)
    * [Exploring Context Menus](#exploring-context-menus)
    * [Save as](#save-as)
    * [Input Boxes](#input-boxes)
    * [Bypass file restrictions](#bypass-file-restrictions)
* [Internet Explorer](#internet-explorer)
* [Shell URI Handlers](#shell-uri-handlers)
* [References](#references)


## Tools

* [kiosk.vsim.xyz](https://kiosk.vsim.xyz/) - tooling for browser-based, Kiosk mode testing.


## Methodology

- Display global variables and their permissions: `export -p`
- Switch to another user using `sudo`/`su`
- Basic privilege escalations such as CVE, sudo misconfiguration, etc. Comprehensive list at [Linux](https://swisskyrepo.github.io/InternalAllTheThings/redteam/escalation/linux-privilege-escalation/) / [Windows](https://swisskyrepo.github.io/InternalAllTheThings/redteam/escalation/windows-privilege-escalation/)
- List default commands in the restricted shell: `compgen -c`
- Container escape if it's running inside a `Docker`/`LXC` container
- Pivot onto the network
    - Scan other machines on the network or attempt SSRF exploitation
    - Metadata for Cloud assets, see `cloud/aws` and `cloud/azure`
- Use globbing capability built inside the shell: `echo *`, `echo .*`, `echo /*`


## Gaining a command shell

* **Shortcut**
    * [Window] + [R] -> cmd 
    * [CTRL] + [SHIFT] + [ESC] -> Task Manager
    * [CTRL] + [ALT] + [DELETE] -> Task Manager 
* **Access through file browser**: Browsing to the folder containing the binary (i.e. `C:\windows\system32\`), we can simply right click and `open` it
* **Drag-and-drop**: dragging and dropping any file onto the cmd.exe 
* **Hyperlink**: `file:///c:/Windows/System32/cmd.exe`
* **Task Manager**: `File` > `New Task (Run...)` > `cmd`
* **MSPAINT.exe**
    * Open MSPaint.exe and set the canvas size to: `Width=6` and `Height=1` pixels
    * Zoom in to make the following tasks easier
    * Using the colour picker, set pixels values to (from left to right):
        ```ps1
        1st: R: 10,  G: 0,   B: 0
        2nd: R: 13,  G: 10,  B: 13
        3rd: R: 100, G: 109, B: 99
        4th: R: 120, G: 101, B: 46
        5th: R: 0,   G: 0,   B: 101
        6th: R: 0,   G: 0,   B: 0
        ```
    * Save it as 24-bit Bitmap (*.bmp;*.dib)
    * Change its extension from bmp to bat and run 
    

## Sticky Keys

* Spawn the sticky keys dialog
    * Via Shell URI : `shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}`
    * Hit 5 times [SHIFT]
* Visit "Ease of Access Center"
* You land on "Setup Sticky Keys", move up a level on "Ease of Access Center"
* Start the OSK (On-Screen-Keyboard)
* You can now use the keyboard shortcut (CTRL+N)


## Dialog Boxes

### Creating new files

* Batch files – Right click > New > Text File > rename to .BAT (or .CMD) > edit > open
* Shortcuts – Right click > New > Shortcut > `%WINDIR%\system32`


## Open a new Windows Explorer instance

* Right click any folder > select `Open in new window`


## Exploring Context Menus

* Right click any file/folder and explore context menus
* Clicking `Properties`, especially on shortcuts, can yield further access via `Open File Location`

### Save as

* "Save as" / "Open as" option
* "Print" feature – selecting "print to file" option (XPS/PDF/etc)
* `\\127.0.0.1\c$\Windows\System32\` and execute `cmd.exe`

### Input Boxes

Many input boxes accept file paths; try all inputs with UNC paths such as `//attacker–pc/` or `//127.0.0.1/c$` or `C:\`


### Bypass file restrictions

Enter *.* or *.exe or similar in `File name` box


## Internet Explorer

### Download and Run/Open

* Text files -> opened by Notepad

### Menus

* The address bar
* Search menus
* Help menus
* Print menus
* All other menus that provide dialog boxes


### Accessing filesystem

Enter these paths in the address bar:

* file://C:/windows
* C:/windows/
* %HOMEDRIVE%
* \\127.0.0.1\c$\Windows\System32


### Unassociated Protocols

It is possible to escape a browser based kiosk with other protocols than usual `http` or `https`. 
If you have access to the address bar, you can use any known protocol (`irc`, `ftp`, `telnet`, `mailto`, etc.) 
to trigger the *open with* prompt and select a program installed on the host.
The program will than be launched with the uri as a parameter, you need to select a program that will not crash when recieving it.
It is possible to send multiple parameters to the program by adding spaces in your uri.

Note: This technique required that the protocol used is not already associated with a program.

Example - Launching Firefox with a custom profile:

This is a nice trick since Firefox launched with the custom profile may not be as much hardened as the default profile.

0. Firefox need to be installed.
1. Enter the following uri in the address bar: `irc://127.0.0.1 -P "Test"`
2. Press enter to navigate to the uri.
3. Select the firefox program.
4. Firefox will be launched with the profile `Test`. 

In this example, it's the equivalent of running the following command:
```
firefox irc://127.0.0.1 -P "Test"
```


## Shell URI Handlers

A URI (Uniform Resource Identifier) handler is a software component that enables a web browser or operating system to pass a URI to an appropriate application for further handling. 

For example, when you click on a "mailto:" link in a webpage, your device knows to open your default email application. This is because the "mailto:" URI scheme is registered to be handled by an email application. Similarly, "http:" and "https:" URIs are typically handled by a web browser.

In essence, URI handlers provide a bridge between web content and desktop applications, allowing for a seamless user experience when navigating between different types of resources.

The following URI handlers might trigger application on the machine: 

* shell:DocumentsLibrary
* shell:Librariesshell:UserProfiles
* shell:Personal
* shell:SearchHomeFolder
* shell:System shell:NetworkPlacesFolder
* shell:SendTo
* shell:Common Administrative Tools
* shell:MyComputerFolder
* shell:InternetFolder


## References

* [PentestPartners - Breaking out of Citrix and other restricted desktop environments](https://www.pentestpartners.com/security-blog/breaking-out-of-citrix-and-other-restricted-desktop-environments/)
* [Breaking Out! of Applications Deployed via Terminal Services, Citrix, and Kiosks - Scott Sutherland - May 22nd, 2013](https://blog.netspi.com/breaking-out-of-applications-deployed-via-terminal-services-citrix-and-kiosks/)
* [Escaping from KIOSKs - HackTricks](https://book.hacktricks.xyz/physical-attacks/escaping-from-gui-applications)
* [Breaking out of Windows Kiosks using only Microsoft Edge - Firat Acar - May 24, 2022](https://blog.nviso.eu/2022/05/24/breaking-out-of-windows-kiosks-using-only-microsoft-edge/)
* [HOW TO LAUNCH COMMAND PROMPT AND POWERSHELL FROM MS PAINT - 2022-05-14 - Rickard](https://tzusec.com/how-to-launch-command-prompt-and-powershell-from-ms-paint/)