Kiosk Escape

Kiosk Escape Techniques

This skill provides techniques for breaking out of restricted environments like kiosks, locked-down workstations, Citrix/RDS/VDI sessions, and single-application modes.

Physical Layer Checks

Start here if you have physical access to the device:

GUI Application Layer

Common Dialog Exploitation

Many applications offer dialogs that provide full Explorer functionality. Look for:

• Close/Close as
• Open/Open with
• Print
• Export/Import
• Search
• Scan

What to try in these dialogs:

• Modify or create new files
• Create symbolic links
• Access restricted areas
• Execute other applications

Command Execution via "Open With"

Use "Open with" to launch shells:

Windows binaries:

• cmd.exe, command.com
• Powershell, Powershell ISE
• mmc.exe, at.exe, taskschd.msc
• See LOLBAS Project for more

*NIX shells:

• bash, sh, zsh
• See GTFOBins for more

Windows Techniques

Bypassing Path Restrictions

Environment variables - These point to accessible paths:

Other protocols to try:

• about:, data:, ftp:, file:, mailto:, news:, res:, telnet:, view-source:

Symbolic links - Create links to restricted areas

UNC paths - Connect to shared folders:

• \\127.0.0.1\c$\Windows\System32 (local C$ share)

Shell URIs

Type these in address bars or file dialogs:

shell:Administrative Tools
shell:DocumentsLibrary
shell:Libraries
shell:UserProfiles
shell:Personal
shell:SearchHomeFolder
shell:System
shell:NetworkPlacesFolder
shell:SendTo
shell:Common Administrative Tools
shell:MyComputerFolder
shell:InternetFolder
shell:ControlPanelFolder
shell:Windows
shell:ProgramFiles
shell:Profile

GUID-based shell URIs:

shell:::{21EC2020-3AEA-1069-A2DD-08002B30309D}  → Control Panel
shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}  → My Computer
shell:::{208D2C60-3AEA-1069-A2D7-08002B30309D}  → My Network Places
shell:::{871C5380-42A0-1069-A2EA-08002B30309D}  → Internet Explorer

Keyboard Shortcuts

Accessibility Shortcuts

Restricted Desktop Breakouts (Citrix/RDS/VDI)

Dialog-box pivoting:

• Use Open/Save/Print dialogs as Explorer-lite
• Try *.* or *.exe in filename fields
• Right-click folders → "Open in new window"
• Use Properties → "Open file location"

Create execution paths:

• Create .CMD or .BAT files
• Create shortcuts pointing to %WINDIR%\System32\cmd.exe
• Drag-and-drop files onto cmd.exe to launch a prompt

Task Scheduler bypass:

• If interactive shells are blocked but scheduling is allowed:
• Use taskschd.msc or schtasks.exe to create a task running cmd.exe

Weak allowlists:

• If execution allowed by filename/extension: rename payload to permitted name
• If allowed by directory: copy payload into allowed program folder

Find writable staging paths:

echo %TEMP%
accesschk.exe -uwdqs Users c:\
accesschk.exe -uwdqs "Authenticated Users" c:\

Accessing Filesystem from Browser

Try these path formats in browser address bars:

file:/C:/windows
file:/C:/windows/
file:/C:/windows\
file://C:/windows
file://C:/windows/
C:/windows
C:/windows/
C:\windows
C:\windows\
%WINDIR%
%TMP%
%TEMP%
%SYSTEMDRIVE%
%SYSTEMROOT%
%APPDATA%
%HOMEDRIVE%

Downloadable Tools

• Console: https://sourceforge.net/projects/console/
• Explorer++: https://sourceforge.net/projects/explorerplus/files/Explorer%2B%2B/
• Registry editor: https://sourceforge.net/projects/uberregedit/

Browser Tricks

JavaScript File Dialog

Create a file input dialog using JavaScript:

document.write('<input type=file>')

Internet Explorer Image Toolbar

Click on images to reveal toolbar with:

• Save
• Print
• Mailto
• Open "My Pictures" in Explorer

Backup iKat Versions

• http://swin.es/k/
• http://www.ikat.kronicd.net/

iPad Techniques

Gestures

Power/Screenshot

iPad Keyboard Shortcuts

System shortcuts:

Navigation:

Safari:

Mail:

References

• Breaking out of Citrix and restricted desktops
• iPad gestures guide
• iPad shortcuts
• Best iPad keyboard shortcuts
• iPad keyboard shortcuts
• Show file extensions in Windows
• LOLBAS Project
• GTFOBins