Alternate data streams.
So we're currently within the Windows file system
vulnerability section of this course,
and the primary vulnerability that we're
going to be focusing on within this section
is alternate data streams.
So we're going to take a look at what alternate data streams
are in the context of the standard Windows file system,
as well as how they're used or exploited
by attackers, primarily in order to evade detection.
All right, so what are alternate data streams,
also known as ADS?
Alternate data streams, also known as ADS,
is an NTFS file attribute.
NTFS is the default format for Windows installations,
or for Windows computers.
So if you have ever installed Windows,
you know that you'll actually need
to format your hard drive into the NTFS format
in order to install Windows on it, right?
So ADS is essentially an NTFS file attribute
and was designed to provide compatibility with the MacOS
HFS, or the hierarchical file system for MacOS.
All right?
So what this means, really, is that whenever
you create a new file on an NTFS formatted drive,
it will typically have two different forks
or streams of data.
All right?
So whenever you create a text file,
a document file, really any file,
whenever you download an MP3, an MP4, really any
file with any extension, they're going
to be two streams of data.
All right?
So you're going to have a data stream.
This is the default stream that contains the data of the file.
So for example, if I create a TXT file,
the data stream is essentially the data that's
within the text file, right?
And whenever I open up the text file,
any text that I've typed in there
is going to be displayed to me, and that's essentially
the data stream.
You then have the resource stream,
which will typically contain the metadata of the file.
So for example, if I've created a text file,
that text file is going to have a certain amount of metadata
related to it or attached to it.
And again, as we know, metadata is simply just data about data.
So in the case of NTFS or in the case of ADS,
the metadata will typically be information
pertinent to when the file was created, who it was created by,
et cetera.
And of course, this is very different for different file
formats.
So for example, if I'm talking about an MP3 file,
the metadata of an MP3 file will typically entail information
like the duration of the MP3 file
or the duration of the music, or the song rather,
as well as the file size, the actual composer
or the artist that created the song, et cetera.
Right?
Now attackers can use ADS to hide malicious code
or executables in legitimate files
in order to evade detection.
All right?
Now this can be done by storing the malicious code
or executables in the file attribute resource stream,
also known as the metadata stream, of a legitimate file.
So an example of this would be if I had an executable that
was malicious in nature, I can essentially
use ADS to essentially hide the payload within the metadata
or the resource stream of a legitimate file.
So I can hide it in the resource stream of a text file,
and whenever I run the text file with the resource
stream specified, and of course the resource stream
will contain the executable, then the executable
will be executed.
And of course, this will make sense
once I switch over to the Windows system
and demonstrate this.
So this technique is usually used
to evade basic signature-based antiviruses
and static scanning tools.
And it really isn't an advanced evasion technique.
It is very useful or helpful if you
are trying to evade evasion from or by administrators
or by users on the system.
So this is a great way of hiding malicious payloads
or executables in legitimate files.
Therefore, again, making it very difficult to
detect whether the system has been compromised.
So we're actually going to be demonstrating,
or we're going to be taking a look at how this can be
done in a few seconds, right?
So this video doesn't have a lab attached to it, again,
primarily because of the actual techniques
I'll be demonstrating.
You can easily replicate these techniques on your own Windows
system.
It doesn't have to entail the use of a malicious payload.
It can just be any executable that you'd like
to hide in a legitimate file.
So I'll switch over to the Windows VM
and we can get started and take a look at how this can be done.
All right.
So I'm back on a Windows seven VM.
This will work on any modern version of Windows, really,
so again, I'm just going to be demonstrating
this on Windows 7.
So again, what I'm going to do is
I'm just going to navigate to the temp directory here,
and I'll show you how this works.
All right, so I'll just open up my C drive,
and I have the temp directory here.
Fantastic.
OK, so what we can do is--
let's say I wanted to create a text file.
I'll just open up my command prompt here
and I'll just minimize that so you can see what's going on.
I'm just going to expand this so we can actually
see what's going on here.
For some reason, it doesn't want to expand there,
but there we go.
So I'm currently within the Win 7 home directory.
So I can head over to my desktop, right,
and I can create a file, a text file for example, with Notepad.
So I can say Notepad, and then I can say, for example, test.txt.
Right?
So that's typically how you'd create a file.
So I can click on it there.
It's going to say "cannot find the text file"
or the default call test.txt.
Do you want to create it?
I'm going to hit yes.
And then I can enter in some basic data like hello, world.
Something very basic like that.
And I can hit save.
OK?
So that's created on my desktop, and you can see it here.
So again, whenever I open up a file, this is the data stream,
or rather, this is the data that stored within the data stream.
Right?
If I right click on the file and I
click on properties and details, this
is the metadata of the file, so this is essentially
the resource stream.
And what we can do is, we can actually
hide a malicious payload within the resource stream,
and whenever we execute the file or whenever we open this file,
we can specify that we want to execute the malicious payload.
So that's just an example.
So I can say, rm test.txt.
Sorry, I can just say, del test.txt.
I keep forgetting that I'm working on a Windows system.
So what I can do now is, I can actually show you how
alternate data streams work.
So if I create another text file called--
I'll just use notepad here, and I'll say test.txt.
I can also essentially hide a file within test.txt.
And we can call it secret.txt.
Now, what this will do is, it will open up secret.txt
with Notepad.
Remember, it's not opening up test.txt.
So if I enter, it's going to say right over here,
it cannot find the file test.txt-- secret.txt.
So I'll hit Yes.
So I'm currently working within the hidden secret.txt file.
So I can enter data in here.
So I can say, this is hidden.
There we are, and I can hit Save.
And if I close that up, and I open up test.txt,
you can see test.txt doesn't have anything.
That's weird.
And if I list out the contents of the Desktop,
you can see that we only have the test.txt file.
And you can see that the current size is
0 bytes, which is interesting.
Now, I can also add data to the test.txt file.
So I can say, notepad test.txt, and I hit Enter.
And I can say, this is visible.
This is visible.
And I can save that.
So I can close that up.
And now, whenever I open up test.txt,
I can get the data that's actually visible there.
If I ever wanted to access the hidden file-- which is hidden,
as you can see.
You really cannot tell that we have a hidden file here.
I can utilize Notepad if it is a text file,
or I can use utilize Word if it's a Word file, et cetera.
You get the idea.
So I can say, notepad test.txt.
And I can access the actual resource stream
using the colon, as I did when I was creating the hidden file.
So I'll say, open up the following hidden file
that's in the resource stream of test.txt.
And in this case, we are going to open up secret.txt.
If I hit Open, you can see that is the hidden file.
And that's the hidden data that's
being stored in the resource stream of the legitimate file
or the test.txt file.
So you can now start to understand how
attackers can leverage this.
So I'm just going to delete the test.txt file there.
And I have the WinPEAS binary here.
So WinPEAS is a utility used by penetration testers
to perform local enumeration on a Windows system
in order to identify vulnerabilities that
can be exploited, or vulnerabilities
that can be exploited to elevate our privileges.
So it's not really a malicious file,
but it's something that you want to keep
hidden as much as possible.
So what I'll do is, I'll just rename this here.
I'll rename this to payload.
And, of course, it's not really a payload,
but I can just rename it to that.
And I'll cut it, and I'll put it within the Temp directory.
Because, as I said, this is where you typically
want to hide or store your exploit files or payloads.
So it's currently within the Temp directory.
So I'll just use my terminal here or my command
prompt to navigate to the root of the C drive.
And under Temp, you can see we have the payload.exe file here.
So I can use the type command and then
redirect the output of payload.exe
into a new legitimate text file.
And then, of course, I'm going to pass
in the actual executable into the legitimate text file
resource stream.
And I can do that by saying, type.
And then I say, payload.exe.
And I'll redirect the output.
And I'll say, I want to create a new legitimate file maybe
called windowsupdate or windowslog.txt.
And I can essentially hide the executable.
And I'll provide the name of the executable
that we are essentially hiding within the resource stream.
And I'll just call it winpeas.exe.
I'll hit Enter.
You can see that was successfully done.
And we still have the payload file.
And you can see that the windowslog.txt file is actually
0 in terms of its size because we haven't entered any data.
So what an attacker would typically
do is, they would open up Notepad and utilize
the actual file, the windowslog.txt
file that they've created, enter in legitimate data
so that it looks like a legitimate file or text
file that contains log data.
So I can just say log, log 1.
Maybe there's a bit of information there.
And for the for the purpose of brevity, I'll just say,
this is a test file.
Or we can just say, this is visible.
There we are.
And I can close that up.
By list of the contents of this directory,
we still have payload.exe and windowslog.txt
that contains data.
And we can actually delete payload.
So let's delete that because we've already
hidden payload or output the content of payload
into the winpeas.exe file that is currently
stored within the resource stream
of the legitimate windowslog.txt file.
So I'll hit Yes.
Now, I can directly execute this.
And this will probably work on Windows 7.
But I can say start because I'm now executing an executable.
I'll say windowslog.txt.
And I want to execute the hidden winpeas.exe executable
that I hid within the resource stream
of the windowslog.txt file.
So I'll hit Enter.
You can see it's going to tell you
there's no program associated to perform the requested action.
So OK, so this is being done or facilitated
through just the start command.
What we can do is, we can create a symbolic link.
And, of course, if you've never done that before on Windows,
it's fairly simple.
I'll create a symbolic link within the Windows directory,
under System32.
There we are.
And what I'll do here is, I'll say, mklink.
And I'm just going to call this maybe wupdate.
So whenever I type in wupdate within CMD,
it will automatically execute the hidden winpeas executable
that is within the resource stream of the windows update
log file that we just created.
So I'll say, mklink wupdate.exe.
And the file that we want to execute is under--
and I'll just head over into My Computer,
and I'll just get the absolute path
because I need to specify it.
So that's under Temp.
And I'll copy that there.
So that's under Temp.
And the file in this case is called windowslog.txt.
And we then specify the actual executable, which in this case
is going to be winpeas.exe.
And I hit Enter.
And it's going to tell me, you don't
have sufficient privileges to perform this action.
So I'm just going to do this with an elevated session here.
And what I'll do is, I'll just run
the same command I did there.
So again, we're still within the Windows System32 directory.
So I'll say mklink wupdate.exe.
And this is under C. Or I can actually just
paste in what I'd copied.
And the name of the file is windowslog.txt.
And the hidden file within the resource stream
is called winpeas.exe.
I'll lit Enter.
You can see the symbolic link is created.
So whenever I type in wupdate and hit Enter,
it's going to execute--
I'll just open this up here so you can see.
It's going to execute winpeas.
So you can actually see that winpeas has been executed here.
And this will start performing enumeration on the system.
So this is a really, really cool vulnerability
within the Windows file system that not a lot of people
actually know about.
But it is extremely helpful in evading very basic detection
by human beings, or administrators,
or by very basic signature-based antivirus systems.
So again, as I said, this is not really a malicious payload.
But I could have done the same thing for a Meterpreter payload
that I generated with MSFvenom.
And, of course, you're not just limited to hiding
payloads or executables.
You can also hide text files, or documents.
Really, any type of file that you
want you can hide it within a legitimate file,
within the resource stream of the legitimate file.
So that is how alternate data streams work,
and how they can be abused or exploited by attackers in order
to hide their malicious payloads or executables.
So that is going to conclude the practical demonstration
side of this video.
In the next section of this course,
we will be taking a look at the process
of how to dump credentials and hashes from a Windows system.
And, of course, this process will essentially
be done with the hope or with the objective
of dumping hashes or identifying clear text
passwords within memory for the purposes of performing
lateral movement.
And we'll also be setting the stage for password cracking,
more specifically NTLM password cracking or NTLM hash
cracking, which we will be covering in another course.
But that is really what we're going to be exploring.
And we'll also be exploring how we
can use the hashes we have dumped to essentially gain
access to a target system legitimately,
either with PsExec and quite a few other utilities or tools.
So that's going to be it for this video.
And I'll see you in the next video.