HackTheBox Escape: Kiosk Breakout via Edge Browser Yields Full System Access

·1 views

A HackTheBox challenge called Escape presents a Windows machine exposing only Remote Desktop Protocol on port 3389, dropping users into a locked-down kiosk account named KioskUser0. The kiosk environment blocks most applications via an allowlist, but Microsoft Edge can be launched through the Start menu search bar. Attackers exploit Edge's ability to browse the local filesystem via the address bar, download system binaries, and bypass the allowlist by renaming executables to match a permitted app. A third-party RDP client found on the system stores masked credentials for an admin account, which are recovered using a Nirsoft password-reveal utility. Since the admin account holds local administrator privileges, a UAC prompt is all that stands between the attacker and full SYSTEM-level access.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

A Beginner's Guide to Acronyms and Jargon in Open Source Development

Developer Thomas Bnt published a beginner-friendly article on DEV Community on July 1 aimed at helping newcomers navigate common acronyms and jargon used in software development and open source communities. The piece targets those new to the field who may feel overwhelmed by technical terminology. It falls under the categories of open source, learning, and beginner resources. The article is estimated to be a four-minute read and received two reactions from the community.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds n8n workflow to automate purchase order data extraction into Google Sheets

A developer named Felix created an n8n automation workflow to help a friend who runs an online shop eliminate hours of manual data entry from purchase order PDFs into Google Sheets. The workflow accepts multiple PDF uploads at once through an n8n form, extracts structured data using the easybits Extractor node, and outputs a formatted spreadsheet ready to push into an ERP system. It captures both header-level fields such as PO number and delivery date, as well as line-item details, flattening each article into its own row with header information repeated across columns. The workflow includes error flagging to identify incomplete extractions and appends the source filename to each row for easy cross-referencing. Felix has published the workflow JSON on GitHub and is inviting the developer community to share their own approaches to automating document-to-spreadsheet data entry.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Designing AI Agents: Why More Autonomy Is Not Always Better

As agentic AI systems grow more capable, software engineers are debating how much independence these agents should actually have. Autonomy is best understood as a design spectrum rather than a binary feature, ranging from simple response generation to goal-driven action with minimal human oversight. The appropriate level of autonomy depends entirely on the problem being solved — a policy-answering HR bot needs far less than an agent investigating live production incidents. Many successful production systems deliberately constrain their agents, setting limits on tool access, task scope, and high-impact actions to improve reliability and trust. Engineers are urged to ask not how autonomous an agent can be, but how autonomous it should be given the specific use case and associated risks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

bat and fzf: A Terminal Workflow to Replace grep-and-scroll File Searches

Developers who rely on grep to search large codebases often waste time scrolling through floods of output to locate a single file or line. Two command-line tools, bat and fzf, can be combined to create a faster, interactive file-search workflow directly in the terminal. bat enhances standard file viewing with syntax highlighting, line numbers, and git change indicators, while fzf provides a fuzzy-search interface that filters results as you type. A shell function called 'fe' pipes fzf's fuzzy finder with bat's live preview pane, allowing developers to locate and open files in their editor without knowing the exact path. The tools are available via Homebrew on macOS and apt on Linux, with Ubuntu users needing to alias 'batcat' to 'bat' due to a package naming conflict.

0 comments Read more at DEV Community