8.6 Desktop Lockdown, Citrix Breakout & Common Windows Applications

8.6 Desktop Lockdown, Citrix Breakout & Common Windows Applications

Two syllabus items sit together here. E7 (Desktop Lockdown) asks for knowledge of techniques to break out of a locked-down Windows desktop or Citrix environment, and the privilege-escalation techniques that follow. E9 (Common Windows Applications) asks for knowledge of significant vulnerabilities in common Windows applications for which public exploit code exists. Both are about the reality that most enterprise compromise starts not at a server but at a user's constrained desktop.

---

1. What "Locked-Down" Means

Organisations restrict end-user environments to limit what a compromised or malicious user can do. Common mechanisms:

• Kiosk mode / assigned access — a single application runs full-screen with no desktop, Start menu or task bar.
• Published applications (Citrix / RDS RemoteApp) — the user sees one application window streamed from a server; there is supposedly no access to the underlying desktop.
• Group Policy restrictions — no access to cmd.exe, regedit.exe, Control Panel, drive letters, Task Manager, the Run box.
• Application allow-listing — AppLocker or Windows Defender Application Control (WDAC) permit only approved executables to run.

The assessor's job is to determine whether these restrictions actually hold. They very often do not, because a lockdown is only as strong as its weakest reachable function.

---

2. Breaking Out: The Reachable-Function Principle

Escape works by finding any UI element that lets you reach the file system or spawn a new process, then pivoting from there.

Common Dialog Boxes

Any File > Open, Save As, Print, Import or Browse dialog contains an embedded Explorer view. From it you can:

• type a path into the filename box (\\attacker\share\payload.exe, C:\Windows\System32\cmd.exe) and press Enter or choose "Open";
• right-click a file and select Open, Run as, or Open with;
• change "Files of type" to "All Files", navigate to System32, and launch cmd.exe, powershell.exe or mmc.exe;
• type a UNC path to browse to attacker-hosted tooling.

If the application can produce any of these dialogs — often via a Help menu, an attachment feature, a print-to-file option, or an "About" box with a hyperlink — the lockdown is broken.

Help, URI Handlers and Embedded Browsers

• Help viewers (.chm, legacy WinHlp) can contain links that execute shell: commands or shortcuts to programs.
• URI/protocol handlers — typing file:///c:/windows/system32/cmd.exe, search-ms:, shell:, or a custom registered scheme into any address-bar-like field, hyperlink, or embedded browser can launch a process.
• Embedded web content — an application that renders HTML (an embedded WebView, an email preview pane, a chat client) may allow navigation to a local resource or a downloaded executable.
• Right-click context menus on the desktop, a document, or a hyperlink frequently expose "Open file location", which lands you in Explorer.

Keyboard Shortcuts

Restrictions that hide the UI often forget the accelerators: Win+R (Run), Win+E (Explorer), Ctrl+Shift+Esc (Task Manager, whose File > Run task spawns a process), Shift+F10 (context menu), and the Windows accessibility hotkeys. The sticky-keys / utilman trick — invoking an accessibility tool that has been replaced with cmd.exe — is the same idea at the logon screen.

Citrix / RDS Published-Application Escape

A published application is just a program running on a shared server with the desktop hidden. Every technique above applies, plus:

• reaching Internet Explorer or Edge through an in-app hyperlink, then using its address bar and download capability;
• using the application's own scripting (Office macros, a database query tool's shell function);
• drive mapping: client drives are often mapped into the session, providing a path to deliver tooling;
• once a shell is obtained on the Citrix server, the target is escalation to SYSTEM and then harvesting the credentials of every other user on that shared server — a Citrix server is a high-value multi-user host.

---

3. Bypassing Application Allow-Listing

AppLocker and SRP restrict which binaries run, but a default policy has well-known gaps:

• LOLBins (Living-off-the-Land Binaries) — signed, Microsoft-trusted executables that can run arbitrary code and are usually allow-listed: rundll32.exe, mshta.exe, regsvr32.exe (the "Squiblydoo" technique), installutil.exe, msbuild.exe, cscript.exe/wscript.exe, certutil.exe (download/decode), and msiexec.exe. The LOLBAS project catalogues these.
• Writable allow-listed locations — default AppLocker rules permit anything under C:\Windows and C:\Program Files. Sub-directories that are world-writable (for example some log or temp folders under C:\Windows) let an attacker place a binary in an allowed path.
• Interpreted and script hosts — if PowerShell is not placed in Constrained Language Mode, or if .hta, .js, .vbs or macro execution is allowed, code runs without an executable of its own.
• Alternate data streams and DLL side-loading — loading a malicious DLL through a trusted, allow-listed executable.

The assessment question is not "is AppLocker enabled?" but "which of these gaps is present?", and the evidence is the specific technique that ran.

---

4. Assessing Common Windows Applications (E9)

Beyond the OS, the syllabus expects assessment of the ubiquitous client applications where public exploit code exists. The methodology is the same as any version-based assessment: identify the exact version, then match it to known vulnerabilities, prioritising software that processes untrusted input.

Office deserves specific attention because it is the dominant initial-access vector. A macro-enabled document that runs on open, a document that fetches a weaponised template from a remote URL (template injection, which needs no macro warning), or an old Equation Editor object are all standard client-side execution techniques — and they escape the desktop lockdown at the same time, because Office's own scripting is the breakout.

Enumerate installed applications and versions during a credentialed audit:

Get-CimInstance Win32_Product | Select Name,Version          # MSI-installed apps
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Select DisplayName,DisplayVersion
Get-AppxPackage | Select Name,Version                        # Store apps

Then correlate versions against vendor advisories and the public exploit catalogues, exactly as in the patch-level audit (section 7.4).

---

5. Reporting and Remediation

A lockdown-escape finding must show the exact path: which application, which dialog or handler, and the resulting process. "The Citrix session could be escaped" is not actionable; "the published PDF viewer's Help > About dialog contains a hyperlink that opens Edge, whose address bar launched file:///c:/windows/system32/cmd.exe, yielding an interactive shell as the session user" is. Remediation combines several layers, because no single control is sufficient:

• Remove reachable escape functions: disable Help hyperlinks, restrict file dialogs, remove unnecessary menus.
• Enforce strong application allow-listing, including blocking known LOLBins and running PowerShell in Constrained Language Mode.
• Patch the client applications, treating Office, browsers and PDF readers as high priority because they process untrusted input.
• Disable Office macros from the internet by default, block child-process creation from Office (Attack Surface Reduction rules), and enable Protected View.
• Harden the Citrix/RDS host itself: least privilege, current patches, and monitoring — because a breakout there exposes every concurrent user.