There are two approaches, the quantitative and the qualitative.
The quantitative consists of fuzzing the input to the sandboxing driver. Use a fuzzing framework like Peach, Sulley or other to fuzz that input and look for crashes or file operations outside the sandbox.
The qualitative approach involves reverse engineering and understand the sandboxing mechanism. Then try to combine that understanding with different features Windows provides and different levels of privilege other components might have. The sandbox might restrict file and network operations but will it restrict injecting into a different process?
Scenario ideas:
- Manipulating other processes and the system to write outside the sandbox
- Using native system routines
NtWriteFile
and ZwWriteFile
- Loading drivers and writing to devices like
\\Device\Harddisk4\Partition2\mydir\myfile.txt
, \DosDevices\c:\path_to_file.txt
, \Device\Tcp
- Loading DLLs with
rundll32.exe
- Unhooking or confusing hooking mechanisms
- Using symbolic links to confuse the sandbox
- Using alternate data streams
fileinsandbox.txt:fileoutsidesandbox.txt
- Performing directory traversals
path\in\sandbox\..\..\..\outside.txt
- Using environment variables like
%SystemRoot%
, %WinDir%
, %TEMP%