Enumerating System Information
At this stage, if the kiosk were connected to the Internet,
we would have a host of options available to us.
With an unrestricted browser, we could install add-on components
such as terminal emulators or file browsers.
We could connect to online tools such as text editors,
which could help us write local files.
In fact, we could even leverage highly-specialized kiosk pentesting tools
like iKAT.
However, since we do not have Internet connectivity,
we will instead begin with some basic readonly enumeration using the file URI.
We’ll begin with the passwd file,
which reveals valuable information.
Based on the login shell in the final column of each line,
there are only three valid login users: root, operator, and guest.
Root and operator share the same home folder,
so operator is likely a utility account of some sort,
perhaps for remote management.
Guest is the user the kiosk interface is currently running under,
which we know is limited.
Moving on,
the version file located in the proc directory
reports that the system is running a fairly recent kernel version,
which means direct kernel exploitation may be difficult.
Next, an examination of the guest user’s home folder
reveals that there are no SSH private keys.
However, even if we did find keys, we could not leverage
them without access to a terminal application or graphical SSH client.
Since our read-only exploration is returning few results,
we’ll move in a new direction leveraging our unlocked browser profile.
Let’s select the Show Downloads Folder option
in an attempt to gain access to some sort of file explorer
This presents another Launch Application dialog box,
indicating that a desktop file browser utility isn’t available.
Since we have access to neither a terminal application nor a file browser,
we are severely limited
in our ability to interact with the underlying operating system.
However, Firefox includes various Web Developer tools that could be useful,
each located under the “hamburger” menu:
Logins and Passwords although enticing
is unfortunately empty.
Many of these tools could be useful, but we’ll begin with Scratchpad