Kiosk Breakout

• http://www.ikat.kronicd.net/

Windows

• https://www.pentestpartners.com/security-blog/breaking-out-of-citrix-and-other-restricted-desktop-environments/

• https://www.trustedsec.com/blog/kioskpos-breakout-keys-in-windows/

• https://habr.com/ru/company/dsec/blog/505600/

Navigating with environment variables and shell directive:

ENV	Location
%HOMEDRIVE%, %SystemDrive%	"C:\"
%WINDIR%, %SystemRoot%	"C:\Windows"
%PROGRAMFILES%	"C:\Program Files"
%COMSPEC%	"C:\Windows\System32\cmd.exe"
%COMMONPROGRAMFILES%	"C:\Program Files\Common Files"
%HOMEPATH%, %USERPROFILE%	"C:\Documents and Settings\Username"
%ALLUSERSPROFILE%	"C:\Documents and Settings\All Users"
%PROGRAMFILES(X86)%	"C:\Program Files (x86)" (only in 64-bit version)
%APPDATA%	"C:\Documents and Settings\Username\Application Data"
%TEMP%, %TMP%	"C:\Documents and Settings\Username\Local Settings\Temp"
%COMMONPROGRAMFILES(x86)%	"C:\Program Files (x86)\Common Files" (only in 64-bit version)

Command	Location
shell:System	"C:\Windows\System32"
shell:Downloads	Current user's "Downloads" folder
shell:MyComputerFolder	"This PC" window

Linux

gtkdialog

HTLM-based pseudo terminal emulator (useful when there's no other terminal apps available):

shell.html

<window>
	<vbox>
		<vbox scrollable="true" width="500" height="400">
			<edit>
				<variable>CMDOUTPUT</variable>
				<input file>/tmp/termout.txt</input>
			</edit>
	</vbox>
	<hbox>
		<text><label>Command:</label></text>
		<entry><variable>CMDTORUN</variable></entry>
		<button>
				<label>Run</label>
				<action>$CMDTORUN > /tmp/termout.txt 2>&1</action>
				<action>refresh:CMDOUTPUT</action>
			</button>
	</hbox>
	</vbox>
</window>

The shell can be invoked with /usr/bin/gtkdialog -f shell.html