Exploring the Filesystem
When we Select Choose…,
the kiosk presents a common file browser interface.
We’ll first click on Home in the left pane
This directory is named guest, revealing that our current username is guest.
This is the account the kiosk software is running as.
Now that we have another interface at our disposal,
we will attempt various keystroke combinations
and attempt to right-click on the interface and the various icons.
Unfortunately this doesn’t produce any results.
The Home menu options seem to be empty,
and we can’t select the Desktop menu.
However, we can browse the filesystem by clicking Other Locations
in the left pane and then Computer in the right pane
This presents the kiosk’s top-level directory
The naming convention of the root filesystem
confirms what we certainly guessed by now:
this is a Unix or Linux-based system.
At this point, we will peruse the filesystem in search of a program to run
when the browser encounters an irc URI.
We’ll search a variety of folders that often contain Linux binaries,
such as /bin.
For example, /bin/bash, the Linux Bash shell,
is a tempting choice,
but when we select it as our application to launch,
then click the Open Link button to open our link with it,
nothing happens and we’re returned to our browser interface.
In order to try another application,
we’ll need to repeat the process of entering an irc URI
into the URL bar and selecting a new application.
Since this is a command-line program,
it won’t work in our graphical environment.
Instead, we should use a common graphical terminal emulator
such as xterm, gnome-terminal or konsole.
Since terminal emulators present an obvious security risk,
they are often removed from kiosk builds,
and as expected, there are none installed on this system.
This could severely limit our ability to interact with the shell.
However, there are a number of other programs that may be helpful,
including busybox
which combines common Linux/Unix utilities
into a single binary.
This could come in handy later on.
In addition, dunstify displays quick pop-up messages
that disappear after a short period of time.
Let’s select this program to determine if Firefox will load it.
We’ll select dunstify in the Launch Application dialog box
and allow it to run.
This created a simple drop-down notification that simply reads
“irc://myhost”.
This is important for two reasons.
First, there does not appear to be a protection mechanism in place
that blocks external applications.
Second, we have discovered that the URI itself
was passed as an argument to dunstify on the command line.
We can safely assume that Firefox ran a command similar to this.
This could explain our earlier difficulty running applications.
If they are being run with a first parameter of irc://myhost
and the program doesn’t accept that as valid, our attempt will fail.
We can test this with various applications in /bin
on our Kali Linux command line.
For example, let’s test bash with this argument.
Because of the invalid argument, bash returns an error
and does not run properly.
We could get around this with /usr/bin/env,
which we can use to set the first parameter as an environment variable
and cancel out the first parameter when calling our target program.
This would create an environment variable named “irc://myhost”
with a value of “something”,
and then run /bin/bash.
If we test this on Kali,
it works fine,
but when run on the kiosk through Firefox,
it fails.
As with our attempt at running Bash,
this is likely due to the lack of terminal emulator programs on the system.
Although we could spend much more time experimenting with various system programs
we should take a step back at this point
and remember that one program in particular,
Firefox,
runs perfectly fine on this kiosk and accepts parameters.
We could use this to our advantage.
According to its documentation, the first parameter to Firefox is a URL,
or URI.
Knowing that Firefox accepts irc://myhost as a valid URI,
we could launch Firefox itself with that parameter.
However, that doesn’t seem like a step forward
until we consider Firefox’s other command-line parameters.