Got nothing very interesting exploit-wise that would give me a quick win. Ran whoami /priv to list my privileges.

Ran net user my_user /domain (yes, my_user was domain-joined to simulate an internal attack).Ran wmic product get name, version to enumerate the installed softwares and associated versions.I enumerated the files and shares and found nothing interesting.Aaaaand, the action was denied, probably by a GPO. Instead of rushing straight into the terminal that just popped, I tried to open the Windows Explorer to have GUI access to files and shares by clicking Open file location on the downloaded file. I went to the URL bar and quickly used the file:// scheme to download and open cmd.exe: However, the CTRL+N shortcut to open a new page was not blocked, bingo! We got a new page and Internet access, awesome. More on that here: Kiosk/POS Breakout Keys in Windows So, I’m in Chrome’s kiosk/PoS mode on the tablet and every Windows shortcut is blocked such as WIN+R, ALT+TAB, CTRL+P, ALT+SPACE, etc. Google Chrome running a kiosk/PoS mode on the tablet.Up-to-date Kaspersky Endpoint Security 11 (KES11) on the tablet.Fully patched Windows 10 running on the tablet.Long story short, obtaining the initial shell was more difficult than owning the network due to the antivirus(es) that were required to bypass. However, I could use it as a C2 if I were to successfully compromise the tablet. I had my own laptop but I was not allowed to directly connect to the internal network with it. During a recent engagement, I was given a Windows tablet with no (pentest) tools installed and was asked to test its security and test how far I could go by compromising it.

Kaspersky 11.6