Kiosk Escape Techniques

This skill provides techniques for breaking out of restricted environments like kiosks, locked-down workstations, Citrix/RDS/VDI sessions, and single-application modes.

Physical Layer Checks

Start here if you have physical access to the device:

GUI Application Layer

Common Dialog Exploitation

Many applications offer dialogs that provide full Explorer functionality. Look for:

• Close/Close as
• Open/Open with
• Print
• Export/Import
• Search
• Scan

What to try in these dialogs:

• Modify or create new files
• Create symbolic links
• Access restricted areas
• Execute other applications

Command Execution via "Open With"

Use "Open with" to launch shells:

Windows binaries:

• cmd.exe

  ,

  command.com

• Powershell

  ,

  Powershell ISE

• mmc.exe

  ,

  at.exe

  ,

  taskschd.msc

• See LOLBAS Project for more

*NIX shells:

• bash

  ,

  sh

  ,

  zsh

• See GTFOBins for more

Windows Techniques

Bypassing Path Restrictions

Environment variables - These point to accessible paths:

%ALLUSERSPROFILE%

%APPDATA%

%TEMP%

%TMP%

%USERPROFILE%

%SYSTEMROOT%

%WINDIR%

%PROGRAMFILES%

%COMPUTERNAME%

%COMSPEC%

Other protocols to try:

• about:

  ,

  data:

  ,

  ftp:

  ,

  file:

  ,

  mailto:

  ,

  news:

  ,

  res:

  ,

  telnet:

  ,

  view-source:

Symbolic links - Create links to restricted areas

UNC paths - Connect to shared folders:

• \\127.0.0.1\c$\Windows\System32

  (local C$ share)

Shell URIs

Type these in address bars or file dialogs:

shell:Administrative Tools
shell:DocumentsLibrary
shell:Libraries
shell:UserProfiles
shell:Personal
shell:SearchHomeFolder
shell:System
shell:NetworkPlacesFolder
shell:SendTo
shell:Common Administrative Tools
shell:MyComputerFolder
shell:InternetFolder
shell:ControlPanelFolder
shell:Windows
shell:ProgramFiles
shell:Profile

GUID-based shell URIs:

shell:::{21EC2020-3AEA-1069-A2DD-08002B30309D}  → Control Panel
shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}  → My Computer
shell:::{208D2C60-3AEA-1069-A2D7-08002B30309D}  → My Network Places
shell:::{871C5380-42A0-1069-A2EA-08002B30309D}  → Internet Explorer

Keyboard Shortcuts

CTRL+N

CTRL+R

CTRL+SHIFT+ESC

Windows+E

Windows+R

Windows+D

Windows+F1

Windows+U

SHIFT+F10

CTRL+ALT+DEL

CTRL+ALT+F8

CTRL+ESC+F9

F11

CTRL+H

CTRL+O

CTRL+S

Accessibility Shortcuts

SHIFT

SHIFT+ALT+NUMLOCK

SHIFT+ALT+PRINTSCN

NUMLOCK

Right SHIFT

Restricted Desktop Breakouts (Citrix/RDS/VDI)

Dialog-box pivoting:

• Use Open/Save/Print dialogs as Explorer-lite
• Try

  *.*

  or

  *.exe

  in filename fields
• Right-click folders → "Open in new window"
• Use Properties → "Open file location"

Create execution paths:

• Create

  .CMD

  or

  .BAT

  files
• Create shortcuts pointing to

  %WINDIR%\System32\cmd.exe

• Drag-and-drop files onto

  cmd.exe

  to launch a prompt

Task Scheduler bypass:

• If interactive shells are blocked but scheduling is allowed:
• Use

  taskschd.msc

  or

  schtasks.exe

  to create a task running

  cmd.exe

Weak allowlists:

• If execution allowed by filename/extension: rename payload to permitted name
• If allowed by directory: copy payload into allowed program folder

Find writable staging paths:

echo %TEMP%
accesschk.exe -uwdqs Users c:\
accesschk.exe -uwdqs "Authenticated Users" c:\

Accessing Filesystem from Browser

Try these path formats in browser address bars:

file:/C:/windows
file:/C:/windows/
file:/C:/windows\
file://C:/windows
file://C:/windows/
C:/windows
C:/windows/
C:\windows
C:\windows\
%WINDIR%
%TMP%
%TEMP%
%SYSTEMDRIVE%
%SYSTEMROOT%
%APPDATA%
%HOMEDRIVE%

Downloadable Tools

• Console: https://sourceforge.net/projects/console/
• Explorer++: https://sourceforge.net/projects/explorerplus/files/Explorer%2B%2B/
• Registry editor: https://sourceforge.net/projects/uberregedit/

Browser Tricks

JavaScript File Dialog

Create a file input dialog using JavaScript:

document.write('<input type=file>')

Internet Explorer Image Toolbar

Click on images to reveal toolbar with:

• Save
• Print
• Mailto
• Open "My Pictures" in Explorer

Backup iKat Versions

• http://swin.es/k/
• http://www.ikat.kronicd.net/

iPad Techniques

Gestures

Power/Screenshot

iPad Keyboard Shortcuts

System shortcuts:

F1

F2

F7

F8

F9

F10

F11

F12

⌘ Space

Navigation:

⌘H

⌘⇧H

⌘ (Space)

⌘⇥

⌘~

⌘⇧3

⌘⇧4

⌘⌥D

^⌥H

^⌥H H

Escape

⌘⇧⇥

⌘⇥

Safari:

⌘L

⌘T

⌘W

⌘R

⌘.

^⇥

^⇧⇥

⌘⇧T

⌘[

⌘]

⌘⇧R

Mail:

⌘⌥F

References

• Breaking out of Citrix and restricted desktops
• iPad gestures guide
• iPad shortcuts
• Best iPad keyboard shortcuts
• iPad keyboard shortcuts
• Show file extensions in Windows
• LOLBAS Project
• GTFOBins