Kiosk Browser Enumeration
At this point, since we only have access to Firefox,
we’ll carefully explore the browser interface itself.
In some instances, we may have access to various menu items
which would warrant careful exploration.
However, in this case, there are no menus to explore
so we’ll begin exploring the various buttons, presented as icons,
and other elements of the user interface.
We can move backwards and forwards through the history with the arrow keys,
refresh the page, return home, zoom in and out
and load a new blank tab using the respective buttons.
Clicking and holding down on the back button can show the browser history
or any pages previously visited.
However, in this case, there is no saved history.
In addition to the available buttons,
we can also interact with the URL/address bar.
By entering text into the URL bar,
we are presented with suggested links for keywords that we type.
Unfortunately, trying to click these results only displays an error page
with a lock icon indicating that the pages are not available.
We can also interact with the preferences icon,
displayed as a small gear shown in the suggestions bar.
However, clicking this icon simply opens about:preferences in a blank page,
again indicating that this functionality is restricted.
This development suggests another angle to consider.
Many browsers include keyword addresses
which provide access to various functionality.
However, none of the various Firefox internal keywords,
such as about:config, seem to work.
In this case,
the only obvious way to interact with this kiosk is through the address bar.
The kiosk’s home page URL begins with “file://”.
This indicates that content is stored locally in the kiosk’s filesystem.
Examining the home page url reveals the home page path.
Let’s remove index.html from the URL
in an attempt to browse the directory’s contents.
This presents a directory listing.
Unfortunately, this directory listing doesn’t reveal much.
In some cases we may be able to leverage directory listings
or error messages caused by erroneous requests
to gain information about the server process hosting the pages.
Unfortunately, any attempt to browse higher-level directories
or other locations is denied,
and we discover no meaningful information.
So far this kiosk implementation is rather formidable
and doesn’t offer many obvious avenues for exploration.
However, each kiosk offers various challenges,
so we’ll move beyond the more obvious techniques
and press on with a focus on the address bar.
We already know that the browser renders HTML files
and likely accepts standard HTTP and HTTPS URLs.
However, there are a variety of protocols we can access with
Uniform Resource Identifiers.
For example, the kiosk’s interface presents locally-stored pages
with the file URI.
Let’s explore other URIs.
Several URI schemes, including chrome,
ftp,
mailto,
smb
and others are blocked by the web filtering mechanism
and our lack of external Internet access.
However, the irc:// URI,
which uses the irc protocol
to connect to text-based Internet Relay Chat servers,
presents an interesting dialog
This dialog prompts for an application to handle the protocol.
This is a significant breakthrough
which represents the first crack in this kiosk’s defenses.