{"id":10862,"date":"2026-05-21T08:18:16","date_gmt":"2026-05-21T06:18:16","guid":{"rendered":"https:\/\/the-s-unit.nl\/?p=10862"},"modified":"2026-05-21T08:41:24","modified_gmt":"2026-05-21T06:41:24","slug":"infratest-op-een-kassasysteem-zo-komen-hackers-binnen","status":"publish","type":"post","link":"https:\/\/the-s-unit.nl\/en\/infratest-op-een-kassasysteem-zo-komen-hackers-binnen\/","title":{"rendered":"Infratesten op een kassasysteem: zo komen hackers binnen"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

What The Hack<\/a><\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Infrastructure test on a POS system: this is how hackers get in <\/span><\/span><\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"What\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In What The Hack, our hackers show how vulnerabilities are exploited and how organisations can prevent them through anonymised real world cases.<\/p>\n

In this edition, Tijmen, ethical hacker at The S-Unit, shows how he gained administrator privileges on a POS system during an infrastructure test by chaining together multiple vulnerabilities. How does an attack like this escalate, and how can organisations break the chain before serious damage is done?<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Physical access: the starting point of the attack<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Everything started with physical access to the POS system. The system was running on a Windows desktop, but without a mouse or keyboard attached. No problem, during infrastructure tests I always bring a wired keyboard.<\/p>\n

I connected a USB keyboard and tried several key combinations to escape the kiosk mode. After 10 minutes without success, I switched to my Flipper Zero as a BadUSB device, hoping automation would uncover a working combination. No luck.\n\nSo I went back to the physical keyboard and started trying more \u201cexotic\u201d combinations beyond the standard payload lists on GitHub. That\u2019s when I hit the jackpot. Pressing CTRL + WINDOWS + ENTER<\/strong> opened the Windows Narrator settings panel. I was out of kiosk mode.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

From browser to Windows Explorer<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The next step was gaining access to the underlying operating system, with the goal of opening PowerShell or Command Prompt. Inside the settings panel, I discovered a link that launched Google Chrome, immediately opening up new possibilities.\n\nAlthough the file:\/\/<\/strong> functionality was blocked, Chrome still offered a clever workaround. When downloading a file, Chrome allows you to open the folder where the file is stored. By saving a webpage with CTRL + S<\/strong> and clicking \u201cOpen folder,\u201d I gained access to Windows Explorer<\/strong>. At that moment, a full system compromise suddenly felt very close.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Cleverly bypassing restrictions<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Through Windows Explorer, I tried to launch PowerShell, but I couldn\u2019t navigate to the right locations on the C: drive because of restricted permissions. Time for plan B.\n\nI used a well known trick: navigating through the \u201cOpen File\u201d dialog. By opening a file, I launched WordPad and clicked \u201cOpen File\u2026\u201d, which gave me a window where I could freely browse the system. From there, I located PowerShell, copied it to the desktop, and launched it. The result: full command line access as a standard user.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Privilege escalation<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

With PowerShell at my disposal, I gained much more control over the Windows environment. Time to become administrator.\n\nWhile inspecting the available services, I discovered I had write permissions on the C: drive, making it possible to hijack a service. I selected a service running as NT AUTHORITY\/SYSTEM<\/strong> that would cause minimal disruption if modified: the Intel Service<\/em>. At the same time, I had to work around two limitations: SentinelOne was active, and the system had no network connectivity.<\/p>\n

That\u2019s why I opted for a simple local payload using msfvenom<\/em> from the Metasploit framework, which created a new administrator account called sunit<\/em>. Tools like msfvenom are usually detected by antivirus solutions, but I decided to take the gamble.<\/p>\n

After that, I placed the payload on a USB stick, created a backup of the original service, and replaced it with my own payload in the correct location on the C:\\ drive. Following a reboot, I logged in as sunit<\/em> and gained administrator access. Game over.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Attack summary<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The attack chain started with connecting a USB keyboard, which allowed me to break out of kiosk mode. From there, I gained access to Windows Explorer, launched PowerShell, and replaced a service executable. After rebooting the system, I had full control over the POS environment.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

How can organisations prevent attacks like this?<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

To prevent scenarios like this, organisations should take the following measures:<\/p>