A researcher demonstrated a new PoC chain in which a Windows Sandbox `.wsb` configuration file uses the `HostFolder` parameter to point to a network (UNC) path. When such a file is opened, the system initiates SMB authentication, resulting in a NetNTLMv2 hash leak even before the sandbox is initialized.

The root cause is that the `Networking=Disable` parameter only affects the guest network, not the host, while `ReadOnly=true` restricts only write access and does not prevent the network connection itself. As a result, an attacker can use a `.wsb` file with a UNC path as a forced authentication primitive to capture host credentials.

📎 Article: https://github.com/0xHossam/UNCagedSandbox

A researcher demonstrated a Windows Sandbox exploit using .wsb files with UNC paths to force SMB authentication, leaking host NetNTLMv2 hashes before initialization despite disabled networking settings.

NTLM Leak via UNC Path in Windows Sandbox