Phoenix Network Forums

A relatively unknown compatibility feature of NTFS, Alternate Data Streams (ADS) provides hackers with a method of hiding root kits, files, or hacker tools on a breached system and allows them to be executed without being detected by the systems administrator.

ADS were introduced into the Windows NTFS file system starting in Windows NT 3.1 (if you use NT, XP, 2000, 2003 etc with a NTFS formatted hard drive, you will have ADS supported). Many applications use ADS to store file attributes and properties. For example if you make a text document, and right click and go into its properties you will see a summary page. This summary information is attached to the file via ADS.

Whilst ADS is useful for storing additional properties along with files - it can be used for so much more than that Smile ADS is very appealing to anyone who would like to be able to "hide" files/data in Windows.

Think of ADS as hidden files that are attached to the visible ones. For example - say I create two files called "text1.txt" and "text2.txt". Using ADS I could hide text2.txt inside text1.txt without affecting the functionality of text1.txt or modifying the size of the file Smile How awesome is that? Smile

Hiding files using ADS is very easy to do and there is no need for extra programs/tools - all you need are common DOS commands like “type”. These commands are used in conjunction with a redirect [>] and colon [:] to fork one file into another. For example:

Code: Select all

type c:\anyfile.exe > c:\winnt\system32\calc.exe:anyfile.exe

If you do this from DOS or start menu "Run..." - the command above will "hide" a program called anyfile.exe inside the windows calculator program!

How do you extract the hidden ADS to run it? Again - this is very easy to do...you can even access the hidden ADS file without needing to "extract" it or do anything like that.

Using our example above, to run the hidden "anyfile.exe" all you would need to do (from DOS or start menu "Run...") is:

Code: Select all

start c:\winnt\system32\calc.exe:anyfile.exe

Here is another example of how to hide a file called c:\hidden.txt inside a file called c:\normal.txt. Type this from DOS (or start menu "Run..."):

Code: Select all

type c:\hidden.txt > c:\normal.txt:hidden.txt

When you want to view the hidden.txt file - all you need to do is:

Code: Select all

notepad c:\normal.txt:hidden.txt

You can even edit the text and save it as normal - the ADS will be updated with the extra "hidden" text and the normal.txt file will remain unchanged! ADS are not limited to files either! there are ways to add ADS to directories Smile For example (from DOS):
:

Code: Select all

cd c:\test
echo "this is some hidden data" > :hidden.txt

This command has now attached an ADS to the c:\test\ directory itself Smile

So - how easy is it to detect when a file has been hidden inside another using ADS? Amazingly enough...ADS are almost impossible to detect using native file browsing techniques like command line or windows explorer! In the example, the file size of calc.exe will show as the original size of 90k regardless of the size of the ADS anyfile.exe. The only indication that the file was changed is the modification time stamp, which is rarely noticed.

experiment with this & find out different possibilities~ Wink

As you can see, Alternate Data Streams are very cool and have a lot of potential - especially since the average PC user will have no clue how to detect them or access them.

Have fun...and behave!

Samppa wrote:I thought we just had a post where people were told not to plagiarise stuff?

Rommaster wrote:Vismaya if you are quoting stuff from other websites, use the quote buttons or write down the link to the source. You can't make other people's copyrighted stuff your own material.

vismaya wrote:i never said, that was written by me...!

al_tyranny wrote:

vismaya wrote:i never said, that was written by me...!

True, but on the other hand, you never said that you didn't write it.

Think of it like this: when you post something, your name shows up beside it.

This is a "signature" on the web showing that you are the author of a unique article.

If you copy-paste someone else's work, it's taking their work and implying that you wrote it!

You wouldn't want anyone else to steal your work, would you?