Vulnerability Development mailing list archives
RE: How to hide a file ?
From: H C <keydet89 () yahoo com>
Date: Tue, 8 Jan 2002 17:27:49 -0800 (PST)
John, The below just goes to show you...don't believe everything you read on the Internet. The statement "" An alternate stream file can't be executed directly because of the colon in the name" is simply incorrect. The 'how' depends on the version of NTFS you're on...NTFS4 (NT) or NTFS5 (2K)...but suffice it to say, this is incorrect. The guys from FoundStone have been publishing how to do so on NTFS4 for a while now...use the 'start' command: c:\> type c:\winnt\notepad.exe > test.txt:np.exe c:\> start test.txt:np.exe Notepad runs... When I ran something similar on 2K... c:\ads>type c:\winnt\notepad.exe > c:\ads:np.exe This copied the executable into an ADS associated with the directory listing. When I ran it, it showed up as 'ads' in both the Task Manager and pslist.exe. Other tools provide equally interesting results.
Grep'd from http://www.cknow.com/vtutor/vtntfsads.htm " An alternate stream file can't be executed directly because of the colon in the name (which is only used for drive letters at the command prompt), but the files can be exploited by viruses that make their way into files saved as part of the normal stream. In one such exploit the virus (Streams) creates a copy of itself as a temporary EXE file and then copies the original EXE file as an ADS file attached to the temporary EXE file. The temporary EXE file is then renamed to the original EXE name. Now, when the user tries to run the original file they actually run the virus which does its thing and then sends the original program file to the operating system which then runs the program. The only thing you might see is a slight delay in program start."
__________________________________________________ Do You Yahoo!? Send FREE video emails in Yahoo! Mail! http://promo.yahoo.com/videomail/
Current thread:
- RE: How to hide a file ?, (continued)
- RE: How to hide a file ? Farahbakhshian, Mike (OD) (Jan 08)
- RE: How to hide a file ? Altheide, Cory (Jan 08)
- RE: How to hide a file ? H C (Jan 08)
- RE: How to hide a file ? Oleg Kozitski (Jan 08)
- Re: How to hide a file ? Ryan Permeh (Jan 08)
- Re: How to hide a file ? Ron DuFresne (Jan 08)
- Re: How to hide a file ? Blue Boar (Jan 09)
- RE: How to hide a file ? H C (Jan 08)
- RE: How to hide a file ? Mike Theriault (Jan 08)
- RE: How to hide a file ? Matthew LaGrange (Jan 08)
- RE: How to hide a file ? John Stauffacher (Jan 08)
- RE: How to hide a file ? H C (Jan 09)
- Re: How to hide a file ? J. J. Horner (Jan 09)
- Re: How to hide a file ? H C (Jan 09)
- Re: How to hide a file ? J. J. Horner (Jan 09)
- Re: How to hide a file ? H C (Jan 09)
- Re: How to hide a file ? J. J. Horner (Jan 09)
- Re: How to hide a file ? H C (Jan 09)
- Re: How to hide a file ? J. J. Horner (Jan 09)
- Re: How to hide a file ? H C (Jan 09)
- RE: How to hide a file ? John Stauffacher (Jan 08)
- Re: How to hide a file ? Jon Zobrist (Jan 09)