https://blog.msnieman.com/tags/kiosk-escape/Recent content in Kiosk Escape on Myles Nieman — BlogHugoen-usFri, 24 Apr 2026 00:00:00 +0000https://blog.msnieman.com/writeups/vulnescape/Fri, 24 Apr 2026 00:00:00 +0000https://blog.msnieman.com/writeups/vulnescape/An RDP kiosk running Microsoft Edge is escaped by adding a local HTML page and renaming PowerShell to msedge.exe; Remote Desktop Plus stores a masked credential recoverable with BulletsPassView, and a UAC-bypassed elevated PowerShell completes the privilege escalation.