> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/kiosk-breakout.md).

# Kiosk Breakout

* <http://www.ikat.kronicd.net/>

## Windows

* <https://www.pentestpartners.com/security-blog/breaking-out-of-citrix-and-other-restricted-desktop-environments/>
* <https://www.trustedsec.com/blog/kioskpos-breakout-keys-in-windows/>
* <https://habr.com/ru/company/dsec/blog/505600/>

Navigating with environment variables and `shell` directive:

| ENV                            | Location                                                       |
| ------------------------------ | -------------------------------------------------------------- |
| `%HOMEDRIVE%`, `%SystemDrive%` | "C:\\"                                                         |
| `%WINDIR%`, `%SystemRoot%`     | "C:\Windows"                                                   |
| `%PROGRAMFILES%`               | "C:\Program Files"                                             |
| `%COMSPEC%`                    | "C:\Windows\System32\cmd.exe"                                  |
| `%COMMONPROGRAMFILES%`         | "C:\Program Files\Common Files"                                |
| `%HOMEPATH%`, `%USERPROFILE%`  | "C:\Documents and Settings\Username"                           |
| `%ALLUSERSPROFILE%`            | "C:\Documents and Settings\All Users"                          |
| `%PROGRAMFILES(X86)%`          | "C:\Program Files (x86)" (only in 64-bit version)              |
| `%APPDATA%`                    | "C:\Documents and Settings\Username\Application Data"          |
| `%TEMP%`, `%TMP%`              | "C:\Documents and Settings\Username\Local Settings\Temp"       |
| `%COMMONPROGRAMFILES(x86)%`    | "C:\Program Files (x86)\Common Files" (only in 64-bit version) |

| Command                | Location                          |
| ---------------------- | --------------------------------- |
| shell:System           | "C:\Windows\System32"             |
| shell:Downloads        | Current user's "Downloads" folder |
| shell:MyComputerFolder | "This PC" window                  |

## Linux

### gtkdialog

HTLM-based pseudo terminal emulator (useful when there's no other terminal apps available):

{% code title="shell.html" %}

```html
<window>
	<vbox>
		<vbox scrollable="true" width="500" height="400">
			<edit>
				<variable>CMDOUTPUT</variable>
				<input file>/tmp/termout.txt</input>
			</edit>
	</vbox>
	<hbox>
		<text><label>Command:</label></text>
		<entry><variable>CMDTORUN</variable></entry>
		<button>
				<label>Run</label>
				<action>$CMDTORUN > /tmp/termout.txt 2>&1</action>
				<action>refresh:CMDOUTPUT</action>
			</button>
	</hbox>
	</vbox>
</window>
```

{% endcode %}

The shell can be invoked with `/usr/bin/gtkdialog -f shell.html`