Kiosk Enumeration
Since these interfaces are designed with limited functionality,
it is important to first enumerate what is available.
During this process, we will generally not have the luxury of using specialized tools
like those found on our Kali Linux machine.
Instead, we’ll be “living off the land”,
using, or misusing tools already installed on the system
to gain ever-increasing access to the system and its back-end networks.
As we begin our exploration of the console,
we must remember that in a real situation,
we would be physically interacting with the kiosk
through a touch screen, a mouse or trackpad,
and in some cases, a keyboard.
However, for the purposes of this lab,
we’ll simulate physical access to the kiosk with VNC.
Since we’ll rely on a variety of keystroke combinations, we’ll use XTigerVNCViewerx
which provides excellent keyboard shortcut support.
Once the client is running, we can enter the IP address of the kiosk VM
and connect.
To enter fullscreen view, we’ll press F8 to open the preferences menu,
and select Full screen.
This will ensure that all of our keystrokes will be directed to the kiosk.
Once connected, we’re presented with the initial kiosk interface.
This interface consists of a limited functionality browser window.
Let’s begin navigating the kiosk’s displayed pages.
In this case, the only link is the “Contact us” email link,
which doesn’t seem to do anything when clicked.
Although this link didn’t reveal much,
in some situations a link like this could reveal a vulnerable contact form,
or may even launch an email client.
Regardless, it’s best to thoroughly investigate the kiosk app
before leveraging more interesting techniques.
Now that we’ve navigated the various pages presented by the kiosk,
we’ll attempt to “break out” of the expected user experience.
The first, and most obvious avenue is to use the right mouse button,
which, under normal circumstances,
would present various submenus or context menus
we could explore.
Unfortunately for us, right-clicking is disabled,
at least in this application.
If we gain access to another application, we may try this again,
but for now, we’ll move on.
Next, we’ll try various combinations of left,
right, and middle-clicking
combined with shift and ctrl keys
on various items in the interface such as links or menu options.
In this case, these combinations don’t do much.
Taking another approach, we’ll try to escape our maximized browser session
with built-in keyboard shortcuts.
For example, we can use alt + tab to attempt to switch tasks,
and discover that Firefox is the only running application.
This is unfortunate as task switching could open other avenues of exploration.
In order to be thorough,
we’ll attempt a variety of other keyboard shortcut combinations.
Unfortunately, this kiosk doesn’t seem to accept most keyboard shortcuts.
We’ll need to try another approach.