https://iamleandrooooo.github.io/tags/ntcreatelowboxtoken/ Recent content in Ntcreatelowboxtoken on Leandro's Code Cave Hugo en-us Wed, 08 Jul 2026 00:00:00 +0000 https://iamleandrooooo.github.io/posts/the-broker-that-rechecks-access/ Wed, 08 Jul 2026 00:00:00 +0000 https://iamleandrooooo.github.io/posts/the-broker-that-rechecks-access/ 1. What a file broker is, and why it is a sandbox-escape target An AppContainer (or otherwise sandboxed) process cannot touch the filesystem directly - its token carries a restricted capability set, and the object manager denies it any FILE object outside that set. To do legitimate file work it has to ask a broker: a more-privileged component that performs the operation on the sandbox’s behalf and hands back the result.