{"id":665,"date":"2012-05-13T00:23:10","date_gmt":"2012-05-12T23:23:10","guid":{"rendered":"http:\/\/www.phillips321.co.uk\/?p=665"},"modified":"2012-05-13T10:56:10","modified_gmt":"2012-05-13T09:56:10","slug":"nftf-alternative-data-streams-bits-and-pieces","status":"publish","type":"post","link":"https:\/\/www.phillips321.co.uk\/2012\/05\/13\/nftf-alternative-data-streams-bits-and-pieces\/","title":{"rendered":"Alternative Data Streams – bits and pieces."},"content":{"rendered":"
\n

To those not familiar with the world of NTFS. It offers a feature known as Alternate Data Streams<\/a> which can allow a user to create hidden content attached to a file.<\/p>\n

Typically generated using echo or type it normally requires a command prompt to get to generate these files or view the files.<\/p>\n

However an alternative method in XP and 2K\/2K3 series of operating systems was to add data to the summary properties of a text document created in notepad as it turns out this data was held within an ADS associated with the original text file.<\/p>\n

What happens if like me last week you find yourself on a system with a tight group policy forbidding command line access and an execution arbiter that worked from a whitelist of very very few programs?<\/p>\n

You get creative.<\/p>\n

I know:<\/p>\n

1
<\/div><\/td>
type hideme.txt &gt; public.txt:hideme.txt<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n<\/p>\n

will generate an ADS.<\/p>\n

I also know that typing<\/p>\n

1
<\/div><\/td>
notepad c:\\path\\to\\public.txt:hideme.txt<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n<\/p>\n

will let me edit the contents of hideme.txt which would not ordinarily be accessible by any other means.<\/p>\n

Unfortunately opening a file in notepad and throwing public.txt:hideme.txt as a filename within the save as box will not work as windows dislikes the colon.<\/p>\n

But what else runs console commands?<\/p>\n

Batch files – nope not in this case, execution arbiter stops batch files running.<\/p>\n

What about shortcuts?<\/p>\n

Bang on.<\/p>\n

Right click “Create New -> Shortcut”<\/p>\n

Enter in “notepad” without quotes as the target, and complete the wizard with defaults.<\/p>\n

Right click the created shortcut change the target field to show<\/p>\n

1
<\/div><\/td>
%windir%\/system32\/notepad.exe "c:\\path\\to\\public.txt:hideme.txt"<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n<\/p>\n

Save the changes and double click the shortcut.<\/p>\n

Pow! You’re now editing an ADS attached to the public.txt file that you had available earlier, ADS created and without additional tools you’re free to hide data away from an administrators prying eyes on a system that gave you no access to a command prompt, stopped you running Batch files and more…<\/p>\n

What Next<\/span><\/strong><\/p>\n

So with that juicy thing done what else could I do? What about exporting sensitive company data? Maybe the customer contact list for a company or medical records or financial details?<\/p>\n

Hmm okay so I’m going to have to get it off the system some how, but the company is smart and doesn’t allow the use of USB drives so I can’t use an NTFS formatted USB drive to export data (on non NTFS file systems the ADS is dropped as it’s not supported).<\/p>\n

What about CD? Well I did say on non NTFS file systems the ADS disappears. It’s true for CDs ISO9660 and UDF formats don’t support alternate data streams so you’re stuck again.<\/p>\n

Except, what if you change the file?<\/p>\n

What if you zip it? then burn the zip?<\/p>\n

Well sad to say using WINZIP v14+ and the default compressed folders function in windows, I believe you’re out of luck, both tools appeared to just drop the ADS content on the floor.<\/p>\n

Using winrar however to create the zip… I’ve shown that it maintains the ADS across filesystems, now my test was using a local FAT32 formatted partition and an NTFS one, I didn’t actually burn it to CD-ROM so it may not be the case but it’s certainly looking promising.<\/p>\n

If it is the case, having the ability to covertly export and import information using ADS suddenly becomes a big issue.<\/p>\n

I plan on looking into it a bit more as it could have just been a series of flukes that worked for me but it was definitely promising.<\/p>\n

My initial thoughts for this are: uuencoded zip file (ASCII friendly so will play nice as ADS content) containing lots of juicy personal information that shouldn’t be leaked. Add to a benign text file expected to leave the building. Winrar zip the lot, burn to CD… get home and do the reverse.<\/p>\n

Ba doom boom! You’ve just circumvented the whole lot of data controls put in place to protect a companies data.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

To those not familiar with the world of NTFS. It offers a feature known as Alternate Data Streams which can allow a user to create hidden content attached to a file. Typically generated using echo or type it normally requires a command prompt to get to generate these files or view the files. However an alternative […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/665"}],"collection":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/comments?post=665"}],"version-history":[{"count":2,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/665\/revisions"}],"predecessor-version":[{"id":667,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/665\/revisions\/667"}],"wp:attachment":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media?parent=665"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/categories?post=665"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/tags?post=665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}