> For the complete documentation index, see [llms.txt](https://aditya-3.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aditya-3.gitbook.io/oscp/readme/privilege-escalation/windows/citrix-breakout.md).

# Citrix Breakout

Basic Methodology for break-out:

1. Gain access to a Dialog Box.
2. Exploit the Dialog Box to achieve command execution.
3. Escalate privileges to gain higher levels of access. .ica files are used for logging into restricted environments

Try to get access to such dialogs:

<figure><img src="https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2FHRJ3ZWsGzePJfMd5MJrr%2FCitrix%20Breakout.png?alt=media&amp;token=04dddeab-a388-4784-8ae5-e6ee1af3f8eb" alt=""><figcaption></figcaption></figure>

Then enter [UNC](https://learn.microsoft.com/en-us/dotnet/standard/io/file-path-formats#unc-paths) path: `\\127.0.0.1\c$\users\pmorgan`

Same technique to access shares: `\\10.13.38.95\share`

In cases where strict restrictions are imposed on File Explorer, alternative File System Editors like Q-Dir or Explorer++ can be employed as a workaround

Or modify existing *shortcut* files to cmd.exe path. If no existing shortcuts either transer one or create new using powershell(.lnk)

Write a bat file with `cmd` in it.