search

sandboxie-plus / Sandboxie

Sandboxie Plus & Classic
https://Sandboxie-Plus.com
GNU General Public License v3.0
13.83k stars 1.54k forks source link

File Recovery dialog says every file "failed a security check" #4125

Open e-t-l opened 3 months ago

e-t-l commented 3 months ago

Describe what you noticed and did

  1. Open the File Recovery window for a sandbox
  2. Select any file or folder
  3. Click the recover button
  4. Observe the dialog box that says "The file [filename] failed a security check, do you want to recover it anyway?"

How often did you encounter it so far?

Every file recovery action

Expected behavior

I expect to only see this dialog for files with actual security vulnerabilities, not for every single file.

Affected program

Not relevant

Download link

Not relevant

Where is the program located?

Not relevant to my request.

Did the program or any related process close unexpectedly?

No, not at all.

Crash dump

No response

What version of Sandboxie are you running now?

Sandboxie-Plus v1.14.5 64-bit

Is it a new installation of Sandboxie?

I just updated Sandboxie from a previous version (I remember which one it is).

Is it a regression from previous versions?

No; the issue has persisted for as long as I have had Sandboxie installed

In which sandbox type you have this problem?

In a standard isolation sandbox (yellow sandbox icon).

Can you reproduce this problem on a new empty sandbox?

I can confirm it also on a new empty sandbox.

What is your Windows edition and version?

Windows 11 Enterprise 23H2 64-bit

In which Windows account you have this problem?

A local account (Administrator)., An account with UAC protection set to Always notify.

Please mention any installed security software

Avast One

Did you previously enable some security policy settings outside Sandboxie?

No response

Trace log

No response

Sandboxie.ini configuration

[GlobalSettings]
Template=WindowsRasMan
Template=OfficeClickToRun
Template=OfficeLicensing
Template=WindowsLive
Template=WindowsDefender
ForceDisableSeconds=600000
PreferExternalManifest=msedge.exe,y
PreferExternalManifest=Spotify.exe,y
Template=Chrome_KB5027231_fix
Template=Avast_Antivirus
Template=Edge_Fix
OpenClsid={D713F357-7920-4B91-9EB6-49054709EC7A}
DisableWinNtHook=CreateEnclave
DisableWinNtHook=LoadEnclaveData
DisableWinNtHook=InitializeEnclave
DisableWinNtHook=CallEnclave
DefaultBox=DefaultBox
FileRootPath=\??\%SystemDrive%\Sandbox\%USER%\%SANDBOX%
KeyRootPath=\REGISTRY\USER\Sandbox_%USER%_%SANDBOX%
IpcRootPath=\Sandbox\%USER%\%SANDBOX%\Session_%SESSION%
SandboxieLogon=y
EditAdminOnly=y
ForceDisableAdminOnly=y
ExternalManifestHack=msedge.exe,y
NoRestartOnPCA=y
ApproveWinNtSysCall=LoadKeyEx
FakeAdminRights=explorer.exe,n

[UserSettings_0CBE021F]
SbieCtrl_AutoStartAgent=SandMan.exe -autorun
SbieCtrl_EnableAutoStart=y
BoxGrouping=:DefaultBox

[DefaultBox]
Enabled=y
BlockNetworkFiles=y
RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
RecoverFolder=%Personal%
RecoverFolder=%Desktop%
BorderColor=#00ffff,ttl,6
Template=OpenBluetooth
Template=SkipHook
Template=FileCopy
Template=qWave
Template=BlockPorts
Template=LingerPrograms
Template=AutoRecoverIgnore
Template=Local_SysCallPresets
ConfigLevel=10
DropAdminRights=y
FakeAdminRights=y
DavidXanatos commented 3 months ago

for me it works fine, you must have installed the file checker addon: grafik and it fails perhaps you did not allow sigcheck.exe internet access?

Cheers David

offhub commented 3 months ago

@DavidXanatos

Suggestion [3,General]: The command sigcheck.exe was not found, but does exist in the current location. Windows PowerShell does not load commands from the current location by default. If you trust this command, instead type: ".\sigcheck.exe". See "get-help about_Command_Precedence" for more details.

@e-t-l

  1. Go to the C:\Program Files\Sandboxie-Plus\addons\FileChecker folder.
  2. Copy sigcheck.exe to any location.
  3. Disable the FileChecker addon.
  4. Save the following codes to a file with the ps1 extension.
  5. Copy the ps1 and exe files to a location of your choice.
Code #### CheckFileCustom.ps1: ```ps1 param ( [string]$bin ) # Determine paths to the sigcheck executables $sigcheckExe = Join-Path -Path $PSScriptRoot -ChildPath 'sigcheck.exe' # Check if the selected sigcheck executable exists if (-not (Test-Path -Path $sigcheckExe)) { Write-Error "sigcheck executable not found at $sigcheckExe" exit 1 } try { # Run the selected sigcheck executable $sigcheckOutput = & "$sigcheckExe" -vt -accepteula "$bin" # Check for the expected detection pattern if (-not ($sigcheckOutput -match "^\s*VT\s+detection:\s+[0]+\/[^0][0-9]*.*$")) { Write-Output $sigcheckOutput exit 1 } } catch { Write-Error "An error occurred while running ${sigcheckExe}: $_" exit 1 } exit 0 ```
  1. Add the following trigger to the Global Settings section. OnFileRecovery=powershell.exe -NoP -EP Bypass -F "LOCATIONOFYOURCHOICE\CheckFileCustom.ps1" -bin
e-t-l commented 3 months ago

and it fails perhaps you did not allow sigcheck.exe internet access?

I don't even see sigcheck attempting a connection in my firewall manager (Portmaster), nor do I see it in Windows Firewall. What server should it be connecting to?

e-t-l commented 3 months ago

Update: I don't think sigcheck.exe or CheckFile.ps1 are even being run. I didn't yet have a chance to do all the steps you describe, i.e. changing the directory of sigcheck etc, but as a quick test I tried two things:

  1. Inserted a break and alert at the beginning of CheckFile.ps1, as a quick visual indicator of whether the script is being run.
  2. Replaced the contents of \addons\FileChecker\CheckFile.ps1 with the contents you pasted above for CheckFileCustom.ps1 (without changing the actual script name)

Both times, I tried recovering a file and got the exact same behavior as before, which tells me that the CheckFile PS script is not actually being executed for some reason. Again, I haven't tried doing it with the custom path and global trigger like you described yet.

Also, idk if this is important, but I noticed that the sigcheck.exe file that is downloaded when installing File Checker is not the same size as the one included in the original SysInternals suite. Is it an older version of the executable?

offhub commented 3 months ago

Run from CMD to see the errors:

powershell.exe -NoP -EP Bypass -F "C:\Program Files\Sandboxie-Plus\addons\FileChecker\CheckFile.ps1" -bin "exeFile.exe"

Also, idk if this is important, but I noticed that the sigcheck.exe file that is downloaded when installing File Checker is not the same size as the one included in the original SysInternals suite. Is it an older version of the executable?

Version 2.9.0, but 32-bit. Maybe the version you have is 64-bit and its name does not end in 64.

e-t-l commented 3 months ago

Run from CMD to see the errors: powershell.exe -NoP -EP Bypass -F "C:\Program Files\Sandboxie-Plus\addons\FileChecker\CheckFile.ps1" -bin "exeFile.exe"

Replaced "exefile" with an existing filepath. It returns no errors or other messages.

I also tried opening a Powershell console and directly running "C:\Program Files\Sandboxie-Plus\addons\FileChecker\CheckFile.ps1" -bin "exeFile.exe" (again using a real filepath) and it returned a ParseError: "Unexpected token '-bin' in expression or statement."

I don't know what I'm supposed to be seeing here. What does the script return when you run it?

e-t-l commented 3 months ago

Update: trying random different files as arguments seems to return one of three results, without any identifiable pattern:

  1. Nothing. The script does not return any output. 
2. Appropriate sigcheck response.

Sigcheck v2.90 - File version and signature viewer Copyright (C) 2004-2022 Mark Russinovich Sysinternals - www.sysinternals.com

c:\sandbox\etl\malwaretestbox\drive\c\program files\adobe\acrobat dc\acrobat\Acrobat.exe: Verified: Signed Signing date: 8:44 AM 2/10/2024 Publisher: Adobe Inc. Company: Adobe Systems Incorporated Description: Adobe Acrobat Product: Adobe Acrobat Prod version: 23.8.20533.0 File version: 23.8.20533.0 MachineType: 64-bit VT detection: 2/79 VT link: https://www.virustotal.com/gui/file/f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628/detection

3. Null response from Sigcheck.

Sigcheck v2.90 - File version and signature viewer Copyright (C) 2004-2022 Mark Russinovich Sysinternals - www.sysinternals.com

c:\sandbox\etl\malwaretestbox\user\current\appdata\local\crashdumps\Acrobat.exe.23632.dmp: Verified: Unsigned File date: 2:43 PM 4/10/2024 Publisher: n/a Company: n/a Description: n/a Product: n/a Prod version: n/a File version: n/a MachineType: n/a VT detection: Unknown VT link: n/a

offhub commented 3 months ago

If the VT detection result is not 0/XX, a warning is issued. (security check failed)

It would be better if you provide a screenshot of the Sandboxie Plus warning. If it looks like the example below, the recovery script is not working properly.

Example:

issue4125rcvry

giannisp6 commented 1 month ago

If the VT detection result is not 0/XX, a warning is issued. (security check failed)

It would be better if you provide a screenshot of the Sandboxie Plus warning. If it looks like the example below, the recovery script is not working properly.

Example:

issue4125rcvry

I am getting the exact same error in a popup message...

stdedos commented 1 week ago

image

In my case, it is an Enhanced Isolation / Data Protection sandbox. Could be it.