Alternate Data Streams
So far, we have demonstrated various ways of bypassing
AppLocker if the rules are not appropriately configured.
In this section, we’ll work through a slightly more advanced
bypass that abuses a feature of the Windows file system itself.
The modern Windows file system is based on the NTFS
specification, which represents all files as a stream of data.
While the inner workings of NTFS are complex, for the purposes
of this module, it’s important to simply understand that
NTFS supports multiple streams.
An Alternate Data Stream
is a binary file attribute that contains metadata.
We can leverage this to append the binary data
of additional streams to the original file.
To demonstrate this, we’ll create a small Jscript file.
We’ll save this as test.js in the student users home directory
Since we have AppLocker scripting rules in place,
we cannot execute it in its current location.
However, if we can find a file in a trusted location that is
both writable and executable, we could write the contents
of this script to an alternate data stream
inside that file and execute it, bypassing AppLocker.
For example, TeamViewer version 12, which is installed
on the Windows 10 victim machine, uses a log file
that is both writable and executable by the student user.
We can use the native type command to copy
the contents of test.js,
into an alternate data stream of the log file with the :notation:
We’ll use dir /r to verify that the Java script code
was written to the alternate data stream:
The output indicates that the script
has been written to the alternate data stream.
Now we must execute it.
If we simply double-click the icon for the log file,
it would open the log which is the primary stream,
in Notepad as a standard log file.
However, if we execute it from the command line with wscript,
specifying the alternate data stream,
the Jscript content is executed instead.
In this case, the Jscript code executed
and opened a new command prompt,
despite the AppLocker script rules.