All query machines and many service terminals of the National Library of China can jump out of sandbox & amp; Privilege Escalation

All query machines and many service terminals of the National Library of China can jump out of sandbox & amp; Privilege Escalation

Today, I went to guotu to read a book and checked it by the way ......

1. Permission escalation

 

Non-administrator permissions, but you can directly change the administrator user password.
 

 

 

 

2. The service terminal can click the Screen Keyboard next to the screen. win + r pops up and runs out of the sandbox.
 

 

All the following terminals can also jump out of the sandbox + escalate Permissions
 

 

 

 

 

These are only part of the Second-layer terminals, and there should be many more.

Can further penetrate the Intranet ......

Solution:

Strictly Set permissions to prohibit the pop-up Screen Keyboard