In this lesson we're going to talk
about Shell Escape and Kiosk Escape.
Shell escape involves breaking out
of restricted shell environments
to gain unauthorized access to the underlying system.
Kiosk escape refers to bypassing the restrictions
on public or kiosk system
to access the full operating system
or other unauthorized areas.
Let's start with shell escape.
Shell escape occurs when an attacker
can break out of a restricted shell environment
and gain access to the broader system.
This type of attack is particularly relevant
in environments where users are provided
limited command access, such as in shared hosting
or containerized environments.
For example, let's say you are in a restricted shell
that only allows you to use basic command.
If you find a command that permits you
to execute other programs,
you can use it to escape the restricted shell.
One common way to do this
is through a vulnerable application
that can be exploited to execute system commands.
For example, if a text editor
like vi or nano is available,
you might escape by typing :!bash or :!sh
while in the command mode to spawn a shell.
In PowerShell, you can use a similar method
to break out of a restricted environment.
If you have access to certain commandlets or commands,
you can leverage them to gain broader access.
Imagine you're in a restricted PowerShell environment
and you find out that you can use
the Invoke-Expression cmdlet.
You then run the following command.
Invoke-Expression -Command "cmd.exe".
The Invoke-Expression cmdlet
is used to run a command or expression.
But running cmd.exe, you are invoking a new command prompt,
effectively escaping the restricted PowerShell environment.
Next, let's discuss kiosk escape.
Kiosk systems are designed to limit user interaction
to a specific set of applications or functionalities.
These systems are commonly used in public areas
such as information kiosk, ATMs, or internet cafes.
One method to perform a kiosk escape
is by exploiting vulnerabilities in the allowed application.
For example, if the kiosk only allows access
to a web browser,
you can try to leverage the browser's functionality
to gain more control.
In Windows, one approach might be to use
the "Save As" dialogue to access the file system.
First, you would attempt to open the web browser on a kiosk.
Next, you would try to download a file from the internet.
Then, when the "Save As" dialogue appears,
you can navigate through the file system
and try to find executables or command prompts
that might allow further access.
Using PowerShell, you might find a way to execute commands
through a web-based application or misconfigured service.
For instance, let's look at the following command.
In this scenario, Invoke-WebRequest is used to download
a PowerShell script from a remote server.
The script is saved to a location on the local file system,
and then it is executed with the powershell.exe command,
bypassing the execution policy
to run potentially malicious code.
Another example of kiosk escape can be performed
by using Windows Management Instrumentation or WMI.
If you have access to WMI, you can use it
to execute commands like the following.
Now here, this script terminates the current instance
of explorer.exe and starts a new one,
which might provide you with access to the desktop
and other system functionalities
that were previously restricted.
So remember, Shell Escape and Kiosk Escape
are techniques used to bypass restricted environments.
Shell escape breaks out of limited shell access
to gain broader control,
often using vulnerable applications or misconfigurations.
Kiosk escape involves using allowed functionalities
or vulnerabilities in public or kiosk systems
to access unauthorized areas.
Understanding and practicing these techniques
can help you identify and mitigate similar vulnerabilities
in real-world scenarios.