# Full Screen Escape

Try to get access to any Explorer functionalities like "Open,Save,Save as,etc"

### Bypassing path restrictions

You can access most paths via Explorer **and** web browser.

* **Environment variables**: There are a lot of environment variables that are pointing to some path
* **Other protocols**: *about:, data:, ftp:, file:, mailto:, news:, res:, telnet:, view-source:*
* **Symbolic links**
* **Shortcuts**: CTRL+N (open new session), CTRL+R (Execute Commands), CTRL+SHIFT+ESC (Task Manager),  Windows+E (open explorer), CTRL-B, CTRL-I (Favourites), CTRL-H (History), CTRL-L, CTRL-O (File/Open Dialog), CTRL-P (Print Dialog), CTRL-S (Save As)
  * Hidden Administrative menu: CTRL-ALT-F8, CTRL-ESC-F9
* **Shell URIs, these do not work in browser**: 
  * `shell:Administrative Tools`
  * `shell:DocumentsLibrary`
  * `shell:Libraries`
  * `shell:UserProfiles`
  * `shell:Personal`
  * `shell:SearchHomeFolder`
  * `shell:NetworkPlacesFolder`
  * `shell:SendTo`
  * `shell:UserProfiles`
  * `shell:Common Administrative Tools`
  * `shell:MyComputerFolder`
  * `shell:InternetFolder`
  * `Shell:Profile`
  * `Shell:ProgramFiles`
  * `Shell:System`
  * `Shell:ControlPanelFolder`
  * `Shell:Windows`
  * `shell:::{21EC2020-3AEA-1069-A2DD-08002B30309D}` --> Control Panel
  * `shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}` --> My Computer
  * `shell:::{{208D2C60-3AEA-1069-A2D7-08002B30309D}}` --> My Network Places
  * `shell:::{871C5380-42A0-1069-A2EA-08002B30309D}->internet explorer`
  * <https://pastebin.com/raw/DLTeW0HU>
* **UNC paths**: Network paths, you should try to connect to the C$ of the local machine ("\\\127.0.0.1\c$\Windows\System32")

| UNC                       | UNC            | UNC                  |
| ------------------------- | -------------- | -------------------- |
| %ALLUSERSPROFILE%         | %APPDATA%      | %CommonProgramFiles% |
| %COMMONPROGRAMFILES(x86)% | %COMPUTERNAME% | %COMSPEC%            |
| %HOMEDRIVE%               | %HOMEPATH%     | %LOCALAPPDATA%       |
| %LOGONSERVER%             | %PATH%         | %PATHEXT%            |
| %ProgramData%             | %ProgramFiles% | %ProgramFiles(x86)%  |
| %PROMPT%                  | %PSModulePath% | %Public%             |
| %SYSTEMDRIVE%             | %SYSTEMROOT%   | %TEMP%               |
| %TMP%                     | %USERDOMAIN%   | %USERNAME%           |
| %USERPROFILE%             | %WINDIR%       |                      |

### Shortcut to escape

If it's a touch screen just try all the gestures tbh, swipe up up down down left right left right B A Start\
Click on all the corners, an infinite number of times or stuff like 2 click top-left, 1 click bottom right, 360 no scope. You get the idea.

* Sticky Keys – Press SHIFT 5 times&#x20;
* Mouse Keys – SHIFT+ALT+NUMLOCK&#x20;
* High Contrast – SHIFT+ALT+PRINTSCN&#x20;
* Toggle Keys – Hold NUMLOCK for 5 seconds&#x20;
* Filter Keys – Hold right SHIFT for 12 seconds&#x20;
* WINDOWS+F1 – Windows Search&#x20;
* WINDOWS+D – Show Desktop&#x20;
* WINDOWS+E – Launch Windows Explorer&#x20;
* WINDOWS+R – Run&#x20;
* WINDOWS+U – Ease of Access Centre&#x20;
* WINDOWS+F – Search&#x20;
* SHIFT+F10 – Context Menu&#x20;
* CTRL+SHIFT+ESC – Task Manager&#x20;
* CTRL+ALT+DEL – Splash screen on newer Windows versions&#x20;
* F1 – Help F3 – Search&#x20;
* F6 – Address Bar&#x20;
* F11 – Toggle full screen within Internet Explorer&#x20;
* CTRL+H – Internet Explorer History&#x20;
* CTRL+T – Internet Explorer – New Tab&#x20;
* CTRL+N – Internet Explorer – New Page&#x20;
* CTRL+O – Open File&#x20;
* CTRL+S – Save CTRL+N – New RDP / Citrix


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://book.turbosec.net/hacking-methodologies/layer-0-phyisical-and-hardware/full-screen-escape.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.