Environment Variables

In Windows, Environment variables sets of defined values that provide information about the operating system, folder location, and may be used to access applications.

When working with a dialog box, these values can be entered into the address bar that normally shows the full folder path for the files being displayed. To distinguish an environment variable from normal text, Windows encapsulates the text with % characters, e.g. %Homedrive%.

To distinguish an environment variable from normal text, Windows encapsulates the text with % characters, e.g. %Homedrive% and will then display the appropriate data (In the instance of %Homedrive%, whichever drive letter e.g. C:\ , D:\, H:\ etc. will be used and the file explorer/dialog box will navigate to the appropriate location)

Common Environmental Variables to explore are:

· %AppData%

o Returns the path to the AppData folder, which is a hidden folder that stores user-specific application data and settings.

· %CommonProgramFiles% & %CommonProgramFiles(x86)%

o Returns the path to the directory where 64-bit and 32-bit programs are installed.

· %COMPUTERNAME%

o Returns the name of the Computer

· %COMSPEC%

o Executes cmd.exe

· %HOMEDRIVE%

o Returns the drive that has been assigned as the HomeDrive (typically C:\)

· %LOGONSERVER%

o Returns the name of the Domain Controller that authenticated the user

· %PSModulePath%

· %SYSTEMROOT%

o Returns the location where the Windows OS is installed

· %TEMP% & %TMP%

o Returns the location of the temp directory

· %USERNAME%

o Returns the currently logged in users drive

Shell URIs

Shell URIs (Uniform Resource Identifiers) are a way to access certain system resources and functionality. Shell URIs can be identified as they begin with shell: and are followed by the name/keyword of the resource/functionality.

The benefit of using these is that it provides a method to quickly access system resources that can be called from within a dialog box (which is one of our goals during a breakout assessment).

From within the dialog box, we can simply call the shell URI in the address bar

Shell:Personal will then load the current user’s Documents folder

Shell URIs can also be used to access applications that may help be part of our breakout process. Using shell:Common Administrative Tools , provides a range of Windows application to explore

Common Shell URIs to explore are:

· shell:MyComputerFolder

o opens My Computer in File Explorer

· shell:Desktop

o opens the desktop folder in File Explorer

· shell:ControlPanelFolder

o opens the Control Panel

· shell:Common Administrative Tools

o shows a list of a range of admin tools available

· shell:UserProfiles

o shows the contents of C:\Users\ in File Explorer

· shell:SendTo

o opens the SendTo folder which contains shortcuts to send files to different tools

· shell:History

o opens the history folder which contains the current user’s browsing history

‍