CTRL+ESC+HOST - A Look at Evasive Compromise Paths, Kicking Kiosks and Taking ADCs

The talk examines how kiosks and remotely presented applications can be escaped to reach the host behind a constrained interface. The presenters distinguish kiosks, which are public terminals, from presented apps served from a central server, and explain why a compromise matters most when either sits on a network with trusted systems. They introduce a framework for testing these escape-to-host flaws across physical, operating system, application and wireless attack surfaces.

The core of the session focuses on Windows 11 attended access, where restrictions are largely user-interface based. Demonstrated routes include reaching hidden USB storage, abusing Windows settings and file dialogs to launch a shell, and using Teams on certain Lenovo systems to move files. Further cases involve ChromeOS enterprise profile misconfigurations, an HP point-of-sale kiosk exposed by a keyboard shortcut, and Citrix and VMware Horizon apps whose scripting interpreters offered a shell. A live demo changed proxy settings to show how EDR telemetry could be reduced.

The talk closes with defensive guidance. Alerting on a kiosk account that runs anything besides its intended application is a strong starting point, and application control should verify file hashes rather than names. Custom indicators of attack and repeated purple-team testing can close more gaps. The presenters stress that all testing should be authorized.