https://wearethebug.dev/tags/bulletspassview/Recent content on WE ARE THE BUGTradecraften-usFri, 16 Feb 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-escape/Fri, 16 Feb 2024 00:00:00 +0000https://wearethebug.dev/posts/vl-escape/Escape is an Easy Windows machine where users can log in restricted Kiosk mode via RDP without a password. By exploiting the file:// scheme in Microsoft Edge, attackers can browse the file system, bypass restrictions, and open PowerShell. Further enumeration reveals a Remote Desktop Plus profile, whose password can be extracted using BulletsPassView, allowing admin access and UAC bypass to read the root flag.