CVE-2026-34527 Sandboxie-Plus 密码哈希熵减少漏洞

import hashlib def vulnerable_hash(password): """ Simulates the vulnerable logic in Sandboxie-Plus <= 1.17.2 where the high nibble is shifted right by 8 instead of 4. """ digest = hashlib.sha1(password.encode()).digest() hex_str = "" for b in digest: # Vulnerability: Right shift by 8 clears the high nibble (always 0) high_nibble = (b >> 8) & 0x0F low_nibble = b & 0x0F hex_str += f"{high_nibble:X}{low_nibble:X}" return hex_str def correct_hash(password): return hashlib.sha1(password.encode()).hexdigest() if __name__ == "__main__": target_pwd = "SbieAdmin123" print(f"Target Password: {target_pwd}") print(f"Vulnerable Hash (Low entropy): {vulnerable_hash(target_pwd)}") print(f"Correct Hash: {correct_hash(target_pwd)}") # Note: The vulnerable hash generates '0' for every high nibble position.