4

I am doing penetration testing of a sandboxing driver and trying to break the sandbox. It is implemented as a kernel mode driver. A sandboxed process will have :

  • A whitelist of disk locations for read operations
  • A whitelist of disk locations for write operations
  • A whitelist of IP address/ports for outbound connections
    • It should only allow TCP connections to be opened.

    Are there any specific scenarios I can test ? Are there any open source libraries out there for testing a sandboxed environment ? It would be great if anyone can share their prior experience with such type of testing.
    Thanks in advance!

    Note: I need to test for Windows Server 2008 R2 64 bit.

    Improve this question
    5
    • What's wrong with going the usual road hunting down overflows and double-frees?
      – Deer Hunter
      Jan 7, 2013 at 17:46
    • 1
      Another useful idea: do not cross-post the same question (stackoverflow.com/q/14154299/1651408) to several StackExchanges at once. Please mod-close one or the other.
      – Deer Hunter
      Jan 7, 2013 at 17:51
    • @Deer Hunter Thanks for the response, I have written some cases for very large inputs to the driver for checking overflows and likes. However, this is blackbox testing and I am looking for some specific scenarios I can target
      – prthrokz
      Jan 7, 2013 at 17:51
    • 1
      Well I was pointed out to try here due to lack of response at SO. Will close that thread.
      – prthrokz
      Jan 7, 2013 at 17:52
    • 1
      IMHO, you'd want to test restrictions on executing other processes, loading DLLs and performing IPC. All of which can provide side-channels, if it is data leaks that you consider the greatest threat.
      – Deer Hunter
      Jan 7, 2013 at 17:59

    1 Answer 1

    Reset to default
    6

    There are two approaches, the quantitative and the qualitative.

    The quantitative consists of fuzzing the input to the sandboxing driver. Use a fuzzing framework like Peach, Sulley or other to fuzz that input and look for crashes or file operations outside the sandbox.

    The qualitative approach involves reverse engineering and understand the sandboxing mechanism. Then try to combine that understanding with different features Windows provides and different levels of privilege other components might have. The sandbox might restrict file and network operations but will it restrict injecting into a different process?

    Scenario ideas:

    • Manipulating other processes and the system to write outside the sandbox
    • Using native system routines NtWriteFile and ZwWriteFile
    • Loading drivers and writing to devices like \\Device\Harddisk4\Partition2\mydir\myfile.txt, \DosDevices\c:\path_to_file.txt, \Device\Tcp
    • Loading DLLs with rundll32.exe
    • Unhooking or confusing hooking mechanisms
    • Using symbolic links to confuse the sandbox
    • Using alternate data streams fileinsandbox.txt:fileoutsidesandbox.txt
    • Performing directory traversals path\in\sandbox\..\..\..\outside.txt
    • Using environment variables like %SystemRoot%, %WinDir%, %TEMP%
    Improve this answer
    1
    • Thanks a lot! this seems like a good launchpad to explore more :)
      – prthrokz
      Jan 8, 2013 at 5:21

    You must log in to answer this question.

    Not the answer you're looking for? Browse other questions tagged .