Breaking Out! of Applications Deployed via Terminal Services, Citrix, and Kiosks

A pentest shows Claude refuses to build an LSASS dumper, but local DeepSeek and uncensored Qwen models produce a working XOR-encrypted minidumper, making AI-assisted EDR evasion nearly effortless.

A Windows Terminal Server issue allowing dead processes to be resurrected, reported to Microsoft and fixed in MS15-111, demonstrated as an exploitable elevation of privilege.

PowerShell plus the .NET Reflection API can invoke methods from .NET assemblies without an IDE or recompilation, e.g. to decrypt database passwords whose encryption routine lives in the code.

Knowing top vulnerabilities and defenses is half the equation; realistic adversarial testing, not compliance checklists, is the practice that actually improves organizational security.

HyperTerminal on a locked-down Windows XP kiosk becomes a breakout tool: its text capture feature can write a batch file into a writable startup folder, giving code execution at next logon.

Misconfigured SQL Server linked servers let attackers traverse database link networks, access unauthorized data, and deploy shells. The post covers enumerating links via the sysservers table.