Infrastructure test on a POS system: this is how hackers get in
In What The Hack, our hackers show how vulnerabilities are exploited and how organisations can prevent them through anonymised real world cases.
In this edition, Tijmen, ethical hacker at The S-Unit, shows how he gained administrator privileges on a POS system during an infrastructure test by chaining together multiple vulnerabilities. How does an attack like this escalate, and how can organisations break the chain before serious damage is done?
Physical access: the starting point of the attack
Everything started with physical access to the POS system. The system was running on a Windows desktop, but without a mouse or keyboard attached. No problem, during infrastructure tests I always bring a wired keyboard.
I connected a USB keyboard and tried several key combinations to escape the kiosk mode. After 10 minutes without success, I switched to my Flipper Zero as a BadUSB device, hoping automation would uncover a working combination. No luck. So I went back to the physical keyboard and started trying more “exotic” combinations beyond the standard payload lists on GitHub. That’s when I hit the jackpot. Pressing CTRL + WINDOWS + ENTER opened the Windows Narrator settings panel. I was out of kiosk mode.
From browser to Windows Explorer
The next step was gaining access to the underlying operating system, with the goal of opening PowerShell or Command Prompt. Inside the settings panel, I discovered a link that launched Google Chrome, immediately opening up new possibilities. Although the file:// functionality was blocked, Chrome still offered a clever workaround. When downloading a file, Chrome allows you to open the folder where the file is stored. By saving a webpage with CTRL + S and clicking “Open folder,” I gained access to Windows Explorer. At that moment, a full system compromise suddenly felt very close.
Cleverly bypassing restrictions
Through Windows Explorer, I tried to launch PowerShell, but I couldn’t navigate to the right locations on the C: drive because of restricted permissions. Time for plan B. I used a well known trick: navigating through the “Open File” dialog. By opening a file, I launched WordPad and clicked “Open File…”, which gave me a window where I could freely browse the system. From there, I located PowerShell, copied it to the desktop, and launched it. The result: full command line access as a standard user.
Privilege escalation
With PowerShell at my disposal, I gained much more control over the Windows environment. Time to become administrator. While inspecting the available services, I discovered I had write permissions on the C: drive, making it possible to hijack a service. I selected a service running as NT AUTHORITY/SYSTEM that would cause minimal disruption if modified: the Intel Service. At the same time, I had to work around two limitations: SentinelOne was active, and the system had no network connectivity.
That’s why I opted for a simple local payload using msfvenom from the Metasploit framework, which created a new administrator account called sunit. Tools like msfvenom are usually detected by antivirus solutions, but I decided to take the gamble.
After that, I placed the payload on a USB stick, created a backup of the original service, and replaced it with my own payload in the correct location on the C:\ drive. Following a reboot, I logged in as sunit and gained administrator access. Game over.
Attack summary
The attack chain started with connecting a USB keyboard, which allowed me to break out of kiosk mode. From there, I gained access to Windows Explorer, launched PowerShell, and replaced a service executable. After rebooting the system, I had full control over the POS environment.
How can organisations prevent attacks like this?
To prevent scenarios like this, organisations should take the following measures:
- disable unnecessary interfaces such as USB ports
- block unused key combinations
- use AppLocker to restrict access to applications like PowerShell
- ensure standard users do not have write permissions in critical directories such as C:\Program Files
- regularly test the effectiveness of your antivirus solution
- minimise the number of services running with elevated privileges
Want to see how resilient your environment really is? Learn more about our infrastructure testing services here.
