DEF CON 34 Red Team Village Tactic
From Kiosk to Domain Compromise: Learning to Walk Up and Take it All
Created by: CroodSolutions, ShammahWoods, techspence, christian-taillon
Kiosks are everywhere: fast-food ordering screens, digital signage, ticketing and check-in stations, print/ship/office systems, library terminals, point-of-sale devices, and plenty more. Their footprint has exploded, but the security questions around them have not always kept pace.
The July 19, 2024 mass blue-screen event made one thing highly visible: many public-facing kiosks, from airports to ATMs, are Windows systems. That raises practical red-team and defense questions: are these kiosks domain joined, what is network-adjacent to them, what credentials or management tooling are exposed, and how far could a kiosk-originated attack path go?
This repository supports a four-part workshop on hacking and securing kiosks. The lab walks from kiosk escape, to host discovery, to lateral movement, to Active Directory compromise, then closes with defensive thinking to prevent kiosk-to-domain takeover scenarios.
The printable workshop guide is included in this repository:
Note: The DEFCON LAB INFO folder contains usernames and passwords for the labs. If you intend to do this workshop on your own, don't peak!
The lab is structured as a "choose your adventure" exercise:
- DIY Attack: Start from a domain-joined kiosk, escape to the host operating system, and compromise the Active Directory domain without step-by-step help.
- Hard Mode: Start from a non-domain joined Linux kiosk, escape to a shell, gain initial access to Active Directory, and compromise the domain independently.
- Guided Attack: Follow the lab guide from kiosk breakout through Active Directory compromise using step-by-step walkthroughs.
The Active Directory lab uses a small Dunder Mifflin-themed environment:
| Host | Role |
|---|---|
DC01 |
Domain Controller and Certificate Authority |
SRV01 |
IT admin server, file shares, and web server |
WS-Michael |
Standard user workstation |
The guided workshop starts with kiosk escape scenarios, then moves into Active Directory attack paths.
- Escape Login Screen on Clearwave Patient Check-in Kiosk
- Windows 11 Assigned Access Kiosk: Feedback Hub
- Windows 11 Assigned Access Kiosk: File Open Dialog Box
- Windows 11 Assigned Access Kiosk: USB LotL Smuggling
- Windows 11 Assigned Access Kiosk: Open Exploration
- Certificate Template Takeover
- Logon Script Credentials and Scheduled Task
- Unattended Credentials and Unconstrained Delegation
- IT Administrator Ticket Theft
- Shadow Credentials
- Resource-Based Constrained Delegation
- LDAP Passback
The lab guide includes appendices for:
- Generic Windows kiosk escape ideas and keyboard shortcuts
- Basic host, route, network, domain, account, and credential discovery commands
- Active Directory testing tools used throughout the lab
For a broader collection of kiosk escape-to-host material, playbooks, atomic tests, and defensive recommendations, see:
The lab guide references a number of Windows-native utilities and third-party tools, including:
- ADeleg
- Locksmith
- Certify
- Rubeus
- ScriptSentry
- Spray-Passwords
- LocalAdminChecker
- PingCastle
- Whisker
- Powermad
- NetTools
Required lab versions are expected to be staged inside the lab VM at C:\TheDundies.
This material is intended for the DEF CON 34 Red Team Village workshop, controlled lab environments, and systems you own or are explicitly authorized to test. The techniques covered are useful for understanding kiosk risk, Active Directory attack paths, and practical defensive controls, but they should not be run against production or third-party systems without permission.