Breakout 3

When using a browser to launch an executable, the following is true

Not all browsers can launch executables

All browsers can launch executables

Any browser can launch an executable if it uses the file:/// syntax

only built in executables can be launched from a browser

Not all browsers can launch executables

Why does the syntax file:///c:/ work when all other protocols only use 2 // characters e.g. http://?

Because the syntax is file://<host>/<path> so for local files when the host is not given there are still 3 / characters

Because the file:/// command is older than http:// and it is a legacy issue

Because the extra / character escapes the restrictions of the application being used

Because the 3 / characters cause a micro buffer overflow that then allows attackers to access files

Because the syntax is file://<host>/<path> so for local files when the host is not given there are still 3 / characters

Which of the following commands will not open the c drive

file:///c$

-c

file:///c$

Browsers can be used to trigger executables by…

Changing their homepage to a .exe file

downloading extensions

getting administrative permissions

browsers cant execute .exe files

Changing their homepage to a .exe file

Which of the following commands will not navigate to the C:\ drive

%systemroot%

%Homedrive%

%systemdrive%

%systemroot%

Which of the following will execute cmd.exe

%comspec%

%prompt%

%CMDP%

%comspec%

What command can give the hostname of the domain controller

%logonserver%

%DC%

%authserver%

%logonserver%

Which shell URI will open a user's Documents folder

shell:personal

shell:documents

shell:MyDocuments

shell:files

shell:personal

To access administrative tools, which shell URI could be used

shell:Common Administrative Tools

shell:AdminTools

shell:CommonAdministrativeTools

shell:Admin

shell:Common Administrative Tools

It is possible to view the current user's browser history with which command

shell:History

shell:Recyclebin

shell:Secret

shell:<browser>

shell:History

What technique can be used to bypass user restrictions during a desktop breakout assessment?

Registry modification

Data exfiltration

Pass-the-hash

Registry modification

Exit

Confirm Answers