2008-03-19T20:47:41-07:00

17378

7009

16230

2009-07-30T09:05:16-07:00

2008-03-19T20:47:41-07:00

<div style="text-align: center;">Alternate data streams have been around since the beginning of the NTFS file system.  Apparently it was originally created to provide compatibility with HFS. (an old Mac file system.) </div> ADS allows you to fork file data into existing files without affecting their functionality, size, or display. Sexy? I think so! The only thing someone using this covertly has to worry about is timestamps. Lets just get right to it: If you wanted to fork A.exe into B.txt it would look like this: open the command prompt:  type A.exe > B.txt:A.exe ...and then to execute A.exe: start ./ B.txt:A.exe Thats all folks. If you arent scared at this point you werent paying attention or you arent a system or network admin. Allow me to throw some scenarios for the use of this type of thing: 1. Hacker Harry gains entry to a network. Harry realizes that further entry may be gained by investigating the network further, but for that Harry needs tools... tools that any admin will notice are sitting on a server.  Harry then finds a nice little driver directory and uses the lovely dlls to fork a plethora of tools for further use without changing the drivers functionality, size or raising any eyebrows from the admins. 2.  Johnny malware writer wants his program to hide inside of a target machine and do his evil bidding but doesnt want the user to find and destroy it.  Johhny has the evil program hide itself into the system by forking into a known windows application like notepad.  Johnny can then call the program from that location. 3. Slick Adrian decided to make a secret web page, accessable only to him containing sensitive information he wouldnt otherwise trust to be on his server.  He made a php page and forked it in a jpg and was able to call it from the web using a url syntax like: http://whatever.org/image.jpg:secret.php 4. Frisky Tom wanted to hide his porn collection.  He forked all his dirty movies into word documents.  He could even specify which player to open them: C:\>"C:\Program Files\Windows Media Player\wmplayer.exe" "C:\MY_MATH_HW.doc:UBER_PRON.avi" What a forking perv! Here are some other things to keep in mind: 1. Theres no size limit to the streams in ADS. 2. You can put more than one stream on a normal file. 3. ADS can also be used with directories. Be aware that if you make one against the root of a drive I believe its impossible to remove (barring a reformat) 4. A user can only create an ADS where they have write access. 5. Windows File Protection does not protect from adding streams to system files. 6. MS has nothing on the OS or resource kits for detecting ADS. You're gonna have to go third party!  Lucky you theres some good stuff out there, LADS being a popular one: http://www.heysoft.de/nt/lads.zip 7. Streams can only be executed if called directly and usually with the full path to the file given. In other words, you dont execute a stream accidentally. 8. ADS only work on NTFS file systems.  If you push a file with a stream on it to a FAT filesystem the stream dies, not the file. Anyways, have fun with this. I hope Ive opened a whole new world of possibilities for you for better or worse.  Please remember this is just a basic intro into ADS, please see the references and do your own research! Ive also attached a video so you can see this type of thing in action. Its not very long but it gets the point across.  33928

7009

17378

2009-07-30T09:06:18-07:00

8111

2009-07-30T09:06:27-07:00

33929

7009

17378

2009-07-30T09:06:27-07:00