Overview

The machine starts by connecting to RDP with NLA disabled which reveals a KioskUser0 account on the login screen, logging in with an empty password drops into a restricted kiosk session running inside Microsoft Edge, navigating the filesystem via the Edge address bar leads to the user flag, then bypassing AppLocker by renaming binaries to msedge.exe allows running PowerShell to find a Remote Desktop Plus profiles.xml with stored admin credentials, a NirSoft password revealer tool is used to extract the plaintext password, and after runas to admin and triggering UAC elevation via Start-Process with RunAs verb we get a high-integrity shell to read the root flag

Enumeration

and as always we start with nmap

and we got a single port running RDP

so lets do a UPD scan also and as you can see nothing returned by udpx so lets do full scan TCP instead

bash 
udpx -t 10.129.234.51

        __  ______  ____ _  __
       / / / / __ \/ __ \ | / /
      / / / / / / / /_/ /   / 
     / /_/ / /_/ / ____/ |
     \____/_____/_/ /_/|_|
         v1.0.7, by @nullt3r

2026/06/02 01:13:57 [+] Starting UDP scan on 1 target(s)
2026/06/02 01:14:27 [+] Scan completed

but there is nothing there so lets see what we can do with this port

so lets try to login with the guest account but it is disabled

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulnescape]
└──╼ [★]$ nxc rdp 10.129.234.51 -u 'Guest' -p ''
RDP 10.129.234.51 3389 ESCAPE [*] Windows 10 or Windows Server 2016 Build 19041 (name:ESCAPE) (domain:Escape) (nla:False)
RDP 10.129.234.51 3389 ESCAPE [-] Escape\Guest: (STATUS_ACCOUNT_DISABLED)

at this point I figured we have to do user enumeration maybe by brute-forcing but it didn't workout at this point I went back to nxc and read some options of RDP and the one that was interesting was --nla-screenshot and that's where i remembered to check logging it but by disabling NLA and as we can see from the Guest attempt it already showed that it was disabled but i missed that

if you are not familiar with NLA it stands for Network Level authentication and it is a good way to protect the server by validating the user even before starting a session but if it is disabled as in this case it'll start a full visual session and show the login screen to the user which might be used for exploitation if there is attacks against windows at that stage of login

RDP as KioskUser0

now by trying to disable the NLA while connecting it'll actually work

if you are using old version of xfreerdp use -sec-nla instead of this option

bash 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulnescape]
└──╼ [★]$ xfreerdp3 /v:10.129.234.51 /clipboard /dynamic-resolution /sec:nla:off
[01:55:49:385] [94022:00016f47] [INFO][com.freerdp.client.x11] - [xf_pre_connect]: No user name set. - Using login name: jimmex
[01:55:49:387] [94022:00016f47] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x08 -> no RDP scancode found
[01:55:49:388] [94022:00016f47] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x5D -> no RDP scancode found
[01:55:49:388] [94022:00016f47] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: MDSW: keycode: 0xCB -> no RDP scancode found
Domain:
Password:
[01:55:51:932] [94022:00016f47] [WARN][com.freerdp.crypto] - [verify_cb]: Certificate verification failure 'self-signed certificate (18)' at stack position 0
[01:55:51:933] [94022:00016f47] [WARN][com.freerdp.crypto] - [verify_cb]: CN = Escape
[01:55:52:976] [94022:00016f47] [WARN][com.freerdp.core.connection] - [rdp_client_connect_auto_detect]: expected messageChannelId=1008, got 1003[01:55:52:977] [94022:00016f47] [WARN][com.freerdp.core.license] - [license_read_binary_blob_data]: license binary blob::type BB_ERROR_BLOB, length=0, skipping.
[01:55:53:449] [94022:00016f47] [WARN][com.freerdp.core.connection] - [rdp_client_connect_auto_detect]: expected messageChannelId=1008, got 1003
[01:55:53:506] [94022:00016f47] [INFO][com.freerdp.gdi] - [gdi_init_ex]: Local framebuffer format PIXEL_FORMAT_BGRX32
[01:55:53:506] [94022:00016f47] [INFO][com.freerdp.gdi] - [gdi_init_ex]: Remote framebuffer format PIXEL_FORMAT_BGRA32
[01:55:53:584] [94022:00016f47] [INFO][com.freerdp.channels.rdpsnd.client] - [rdpsnd_load_device_plugin]: [static] Loaded fake backend for rdpsnd
[01:55:53:584] [94022:00016f47] [INFO][com.freerdp.channels.drdynvc.client] - [dvcman_load_addin]: Loading Dynamic Virtual Channel ainput
[01:55:53:584] [94022:00016f47] [INFO][com.freerdp.channels.drdynvc.client] - [dvcman_load_addin]: Loading Dynamic Virtual Channel rdpgfx
[01:55:53:585] [94022:00016f47] [INFO][com.freerdp.channels.drdynvc.client] - [dvcman_load_addin]: Loading Dynamic Virtual Channel disp
[01:55:53:585] [94022:00016f47] [INFO][com.freerdp.channels.drdynvc.client] - [dvcman_load_addin]: Loading Dynamic Virtual Channel rdpsnd
[01:55:55:736] [94022:00016f55] [INFO][com.freerdp.channels.rdpsnd.client] - [rdpsnd_load_device_plugin]: [dynamic] Loaded fake backend for rdps

we also could've done this

shell 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/notes]
└──╼ [★]$ nxc rdp 10.129.234.51 -u '' -p '' --nla-screenshot
RDP 10.129.234.51 3389 ESCAPE [*] Windows 10 or Windows Server 2016 Build 19041 (name:ESCAPE) (domain:Escape) (nla:False)
RDP 10.129.234.51 3389 ESCAPE [-] Escape\: (STATUS_LOGON_FAILURE)
RDP 10.129.234.51 3389 ESCAPE NLA Screenshot saved /home/jimmex/.nxc/screenshots/ESCAPE_10.129.234.51_2026-06-02_034249.png

to grab the screenshot only but i needed to know what are we dealing with and we get this, there is a user called KioskUser0 so lets close this and try it with nxc and empty password and if it didn't work we'll brute force it and we get this, there is a user called KioskUser0 so lets close this and try it with NXC and empty password and if it didn't work we'll brute force its password

and as you can see we got it working so lets login using RDP

just so you know we got a hint that the RDP is in Kiosk mode so it is a restricted mode where the user will be able to do limited things based on what the admin configured

bash 
(.venv) ┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulnescape]
└──╼ [★]$ nxc rdp 10.129.234.51 -u 'KioskUser0' -p ''
RDP 10.129.234.51 3389 ESCAPE [*] Windows 10 or Windows Server 2016 Build 19041 (name:ESCAPE) (domain:Escape) (nla:False)
RDP 10.129.234.51 3389 ESCAPE [+] Escape\KioskUser0: (Pwn3d!)

lets login using xfreerdp

plaintext 
┌─[]─[10.10.16.83]─[jimmex@attacker]─[~/htb/labs/vulnescape]
└──╼ [★]$ xfreerdp3 /v:10.129.234.51 /clipboard /dynamic-resolution /u:KioskUser0 /p:''

as you can see just a background at the start you might think it is just a desktop back ground and we get this there is nothing we can do if we tried to select this text and then click some of the icons you'll notice that this is microsoft edge by the look of it and we get this there is nothing we can do if we tried to select this text and then click some of the icons you'll notice that this is microsoft edge by the look of it and another way to figure this out is by clicking alt+tab Pasted image 20260602135453.png and it is msedge

the only thing that worked is the windows menu when i clicked the windows button so lets see what kind of applications we can run the only thing that worked is the windows menu when i clicked the windows button so lets see what kind of applications we can run - if we can't run cmd i will look for explorer - if we can't run explorer i will look for microsoft edge the reason I am thinking about Microsoft edge here cause we are already in one so lets try to open a new one and from it we can try the open dialog to run anything as that user

  • if we can't run cmd i will look for explorer
  • if we can't run explorer i will look for microsoft edge
  • the reason I am thinking about Microsoft edge here cause we are already in one so lets try to open a new one and from it we can try the open dialog to run anything as that user

and as you can see when we search for cmd and click on it nothing happens but when we try open file location it returns an error lets do the and file explorer doesn't return anything back so lets try msedge and as you can see when we search for cmd and click on it nothing happens but when we try open file location it returns an error lets do the and file explorer doesn't return anything back so lets try msedge

and microsoft edge actually works and there is a way to open the file explorer from microsoft edge or any browser isntead of typing a normal URL like this http://something.com we do `C:\` and it'll open a file explorer in the browser with the path C so lets try it and microsoft edge actually works and there is a way to open the file explorer from microsoft edge or any browser instead of typing a normal URL like this http://something.com we do C:\ and it'll open a file explorer in the browser with the path C so lets try it and it actually worked so lets look if we can get the user flag and it actually worked so lets look if we can get the user flag

and we got only 3 user s admin and administrator and KioskUser0 so lets look for the user flag under that user and we got only 3 user s admin and administrator and KioskUser0 so lets look for the user flag under that user

and we got the user flag and we got the user flag

Lateral to Admin

and by using the old way of opening an open dialog to open applications is apps like msedge and paint we can try to get cmd running and by using the old way of opening an open dialog to open applications is apps like msedge and paint we can try to get cmd running

the open dialog way didn't work so I went back to using the windows file explorer and looking for cmd.exe and as you can see it is downloaded if we clicked on that cmd.exe now it might open cmd for us the open dialog way didn't work so I went back to using the windows file explorer and looking for cmd.exe and as you can see it is downloaded if we clicked on that cmd.exe now it might open cmd for us

but clicking on it gives us this lets translate it and see what it says but clicking on it gives us this lets translate it and see what it says

and it says that there is some limitation that is blocking us from running this usually it filters based on the executable name so lets see if we can rename it if we can rename it we'll do this 1. change the name to the name that never exists and try to run if it didn't run it means that the filter is whitelisted not black listed 2. and because the filter is white listed we can name it `msedge.txt` cause we know this name is allowed so lets see what we can do and it says that there is some limitation that is blocking us from running this usually it filters based on the executable name so lets see if we can rename it if we can rename it we'll do this

  1. change the file name to a name that doesn't exist and try to run it, if it doesn't run it means that the filter is whitelisted not blacklisted
  2. and because the filter is white listed we can name it msedge.exe cause we know this name is allowed so lets see what we can do

    blacklisted means there is some apps specifically stated that we can not run and because there is no way they added doesnotexistatall to that blacklist then it is a whitelist whitelisted means there is some apps only that we can run and this way is generally safer

i did the same with powershell cause i like powershell more by clicking that name it got the exact same message meaning it is white-listed and one the exe files we know is permitted for sure is microsoft edge so lets name it to msedge and run it i did the same with powershell cause i like powershell more by clicking that name it got the exact same message meaning it is white-listed and one of the exe files we know is permitted for sure is microsoft edge so lets name it to msedge and run it and as you can see it worked lets see what we can do here and as you can see it worked lets see what we can do here after running some commands to enumerate the privilege there not much we can do so i went back to the file system and i found this interesting folder after running some commands to enumerate the privilege there not much we can do so i went back to the file system and i found this interesting folder

and it has a file called profiles.xml which looks like a setting storage for remote desktop plus so lets find the executable for this remote desktop plus and try to run it and see what we can do and it has a file called profiles.xml which looks like a setting storage for remote desktop plus so lets find the executable for this remote desktop plus and try to run it and see what we can do

and after searching i found it is installed in one of two paths either Program FIles or Program Files(x86) and that's where i found it so lets try to run it the same way as we did with powershell if it isn't permitted to run and after searching i found it is installed in one of two paths either Program Files or Program Files(x86) and that's where i found it so lets try to run it the same way as we did with powershell if it isn't permitted to run

and we got this and remember the file name we found was profile.xml so we may be able to use to get a session and we got this and remember the file name we found was profile.xml so we may be able to use to get a session

so i tried to import the profile but at the first glance the open dialog is still restricted to the download path so i had to download the profile.xml first and did this by going to the profiles.xml in edge and then ctrl+s and save it anyway after importing it we'll see that it imported the admin and its password but we can't see the password lets see if we can connect so i tried to import the profile but at the first glance the open dialog is still restricted to the download path so i had to download the profile.xml first and did this by going to the profiles.xml in edge and then ctrl+s and save it anyway after importing it we'll see that it imported the admin and its password but we can't see the password lets see if we can connect

the old method of opening rdp using GUI after changing its name to msedge didn't work and i don't know way so i went back to shell and opened it using powershell and it worked so lets see if we can connect

if you tried to open RDP using the old way by changing the name it won't work cause you can only download in downloads file and we already named a file called msedge there and you can't rename the powershell while it is running but i created a new folder and moved the rdp to it from downloads and rename it to msedge and run it still will fail

anyway when i tried to connect i got this system error and we get system error so i guess the only way is to find a way around this dotted password to get the password and try to RDP from our attack instead so i guess the only way is to find a way around this dotted password to get the password and try to RDP from our attack instead

after some search i found a utility from nirsoft that reveals the dotted password actual text all i needed to do is to download it to the system and i used http.server for that opened it from the powershell and then opened the remote desktop plus again and hovered the dotted text and back to the app i got it revealed lets try to login using RDP after some search i found a utility from nirsoft that reveals the dotted password actual text all i needed to do is to download it to the system and i used http.server for that opened it from the powershell and then opened the remote desktop plus again and copied the dotted text and back to the app i got it revealed lets try to login using RDP

when i tried to rdp back in

shell 
xfreerdp3 /v:10.129.234.51 /u:admin /p:Twisting3021

I got this error

but i've got this lets take translate it To log in remotely, you must have permission to log in through Remote Desktop Services. By default, members of the Remote Desktop Users group have this permission. If the group you currently belong to does not have this permission, or if this permission has been removed from the Remote Desktop Users group, you must grant this permission manually. but this admin is supposed to RDP ig anyway lets try runas from the powershell instead using the password we got but i've got this lets take translate it

To log in remotely, you must have permission to log in through Remote Desktop Services. By default, members of the Remote Desktop Users group have this permission. If the group you currently belong to does not have this permission, or if this permission has been removed from the Remote Desktop Users group, you must grant this permission manually.

admin is usually permitted to RDP but not in this case anyway lets try runas from the powershell instead using the password we got after runas.exe /user:admin powershell.exe and add password at prompt we've got shell as admin and after `runas.exe /user:admin powershell.exe` and add password at prompt we've got shell as admin lets try to read the flag

lets try to read the flag when i tried to read the flag i don't have access to administrator as admin cause we are not administrator but when i used `whoami /groups` to see what gorups am i part of Administrators group so my guess is i can read administrator rights wise but i can't now cause the UAC sees a different user so it needs me to click on yes to proceed but because this is shell we can't but there is a way to open UAC from powershell using this command `Start-Process powershell -Verb RunAs` and if i tried it when i tried to read the flag i don't have access to administrator as admin cause we are not administrator but when i used whoami /groups to see what gorups am i part of Administrators group
so my guess is i can read administrator permissions-wise but i can't now because the UAC sees a different user so it needs me to click on yes to proceed but because this is shell we can't but there is a way to open UAC from powershell using this command Start-Process powershell -Verb RunAs and if i tried it

and as you can see we got it usually the UAC yes button is the one on the left or the one that isn't selected but default and as you can see we got it usually the UAC yes button is the one on the left or the one that isn't selected but default

and as you can see we still admin user but now we can read flag and as you can see we still admin user but now we can read flag

Resources