GhostLock - SMB deny-share handle research tool. Lock files on

项目说明

<di="center">

<img src="logo.png">

SMB Deny-Share Handle A Research Tool

![Python]()
![Platform]()
![Use]()
![Paper]()
![Site]()

*Ransomware-grade a impact. Zero writes. Zero encryption. Zero traces in your SIEM.*

Research Site · Whitepaper (PDF) · LinkedIn

</div>

---

O

GhostLock demonstrates that a low-pri Windows domain user with standard read access to an SMB share can produce ransomware-equi organizational a impact with zero writes, zero encryption, and zero signals in every beha defense the modern enterprise security stack deploys.

Two techniques, one primitive:

v1 — File-le: CreateFileW with dwShareMode=0 across every file in a share. 32-thread parallel scanner. Hundreds of thousands of handles in minutes.

v2 — Directory-le: CreateFileW with dwShareMode=0 and FILE_FLAG_BACKUP_SEMANTICS on a directory object. One handle. One API call. The entire folder becomes a namespace blackout over SMB.

No CVE. No patch. No . Correct, documented Windows API behavior since Windows NT 3.1.

---

Why This Changes E

| Detection Signal | Encryption Ransomware | GhostLock |
|---|---|---|
| Bulk write I/O | Detectable | None |
| File rename / new extension | Detectable | None |
| Honey file triggered | Write to canary | Read-open only |
| Beha AI (write rate) | Fires | No writes |
| EDR on endpoint | Shellcode / injection | Looks like file indexer |
| DLP / content inspection | Bulk read anomaly | Indistinguishable from backup |
| Network traffic anomaly | Bulk SMB writes | Identical to Word opening a doc |
| Storage session open-file count | Not relevant | Only reliable signal |

---

v2 — Directory-Le Blackout

One handle on a directory subdirectory over SMB produces the following empirically confirmed results:

| Operation | Local NTFS | Over SMB |
|---|---|---|
| Rename file inside dir | Blocked | Blocked |
| List directory contents | Allowed | Blocked |
| Recursive copy / backup | Allowed | Blocked |
| Open directory object | Blocked | Blocked |

The SMB ser directory exclusivity at the namespace level. Get-ChildItem, Explorer browsing, backup agents, and search indexers all fail. The directory becomes operationally in. Indi files at known paths remain accessible — what is destroyed is disco.

---

Requirements

No third-party packages. Pure Python stdlib.

---

Installation

---

Usage

Interactive Mode

Option 1 — file-le, 32-thread scanner, hundreds of thousands of handles:

Option 2 — auto-discovers SMB shares, multi-select:

Option 3 — directory-le blackout, one handle:

CLI Mode

---

Safety Mechanism

For file-le, a sentinel file must exist in the target directory:

Directory-le (option 3) does not require a sentinel — it acquires one handle on a path you explicitly provide.

---

Output

---

Research

> "GhostLock: SMB Deny-Share Handles as a Zero-Pri A Weapon"
> Kim Dvash, May 2026

Read the full paper: zenodo.org/records/20070064

Research site: ghostlock.io

---

Authorized Use Only

---

License

MIT — see LICENSE

---

<di="center">

Kim Dvash · linkedin.com/in/kim-d-5b3114111 · ghostlock.io

dwShareMode = 0x00000000

</div>

项目信息

开发语言：Python

Star 数：157

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕SMB deny-share handle research tool. Lock files on an enterprise share with zero writes, zero encryption, and zero alerts in any behavioral defense. Standard user. One API call. No CVE.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。