When the Milan ticket kiosk gives you cmd.exe instead of a ticket
Description
Meme screenshot shows a public bus-ticket vending machine in Milan. A black banner caption at the top reads, "could not for the life of me figure out how to buy a bus ticket in Milan. it was literally easier to get a shell 😆". The kiosk bezel is labeled "SELEZIONE SELECTION" with "PAGAMENTO" and a card reader on the right, but the touchscreen displays a full Windows desktop window titled "C:\Windows\system32\cmd.exe" running a command prompt over a blue desktop background, with an on-screen keyboard covering the lower half. Instead of the normal ticket UI, the user has somehow escaped kiosk mode and obtained a shell. Technically, the image pokes fun at poor kiosk hardening, broken access control, and how user-hostile UIs sometimes make privilege escalation easier than legitimate usage
Comments
7Comment deleted
Pro tip for Milan’s transit kiosk: skip the 5-step ticket flow and just hit Shift five times - apparently the cheapest fare is a Kerberos golden ticket straight to NT AUTHORITY\SYSTEM
When your UX is so bad that users accidentally discover CVE-2024-MILAN before finding the "Buy Ticket" button, you know someone's getting a strongly worded JIRA ticket about "improving the customer journey."
The kiosk's threat model assumed nobody could reach a shell; the UX assured nobody could reach checkout - only one of those guarantees held
When your production kiosk's error handling is so robust that 'Press Alt+F4 to exit' becomes 'Press any key for root access.' This is what happens when you deploy Windows Embedded without proper lockdown policies - the user journey goes from 'Insert card' to 'INSERT INTO users' faster than you can say 'least privilege principle.' At least the on-screen keyboard works flawlessly, which is more than we can say for the actual ticket purchasing flow. Classic case of spending millions on the hardware and $50 on the security audit
Milan kiosks run bash: normies panic at the prompt, devs instinctively type 'man ticket'
Milan’s ticket kiosk: 6 dialogs to pay, Win+R via the on‑screen keyboard to pop cmd. That’s not kiosk mode, that’s a public CTF
When your kiosk hardening is just “hide the taskbar,” Win+R → cmd.exe becomes the real checkout flow - pretty sure that puts the card reader in PCI scope