A guide to Alternate Data Streams

[parad0x]

So guys,some days age, when glitcher posted a topic formatting a usb. There he told about ADS then I searced a lot and finally learn't something which I want to share with you all guys. Most don't know about the Alternate Data Streams.  Alternative Data Stream support was added to NTFS (Windows NT, Windows 2000 and Windows XP) to help support Macintosh Hierarchical File System (HFS) which uses resource forks to store icons and other information for a file. While this is the intended use (as well as a few Windows internal functions) there or other uses for Alternative Data Streams that should concern system administrators and security professionals. Using Alternative Data Streams a user can easily hide files that can go undetected unless closely inspection. This tutorial will give basic information on how to manipulate and detect Alternative Data Streams.
So, Lets start.

0x00. Creating an ADS
It is very simple to create ADS.We'll use cmd to create these streams. First we'll create a text file named test.

Code: [Select]

C:\>echo This is a test file to make ADS > test.txt
C:\>type test.txt
This is a test file to make ADS
The '>' operator is called redirect operator and is used to redirect the output of any command to a file. In this case, we are redirecting "This is a test file to make ADS" into the file "test.txt".
Now we'll make an ADS behind our text file that we recently created. For this ':' operator is used.

Code: [Select]

C:\>echo experiment> test.txt:hidden.txtTo view what's in the hidden.txt then run

Code: [Select]

C:\>notepad test.txt:hidden.txtWe used notepad to open the ADS cause the 'type' command don't understand the ':' operator.
Their are many benefits of ADS which I'll be telling you about.Have patience...

Similiarly, we can create ADS on directories.That' true, just look here.

Code: [Select]

C:\>echo hello>ADS:hidden.txt To verify type in cmd

Code: [Select]

C:\>notepad ADS:hidden.txt
0x01. Creating and running executables
Not only text files, you can hide videos, exe also. Look here, I'll show you how to hide an executable behind a file.

Code: [Select]

C:\>cd ADS
C:\ADS>echo this is to show how to hide an exe > test1.txt
C:\ADS>type notepad.exe>test1.txt:calc.exe
The 'start' command is used to run the executable. 'start' commands need to know the full path of the executable.
To run this exe

Code: [Select]

C:\ADS>start ./test1.txt:calc.exeIf something went right, you'll see a notepad window in front of you.

0x02. Hiding and running videos
You can also put(hide) videos behind the files using ADS, but for playing them, you will need to give the path of the video player and the full path of video.Like, I'll be hiding a video named 'Batman Begins.mkv'

Code: [Select]

D:\Movies>type "Batman Begins.mkv">"test.txt:batman begins.mkv"
D:\Movies>"C:\Program Files\VideoLAN\VLC\vlc.exe" "D:\Movies\test.txt:batman begins.mkv"If everything goes right, you'll find vlc playing Batman Begins.

0x03. Finding Alternate Data Streams
There are many softwares on the net such as LADS and many more.Some antivirus also catches ADS.

0x04. Deleting ADS
To delete the ADS we created on our file test(or on any file) do

Code: [Select]

D:\Movies>ren test.txt abc.txt
D:\Movies>type abc.txt > test.txt
D:\Movies>del abc.txtWhat we did here:
We renamed the test.txt file to abc.txt then we copied the content of abc.txt to text.txt and then deleted the file containing ADS.

0x05. Benefits of ADS
1.) You can hide your files, videos,and anything you want to hide from others.
2.) You can hide malwares, trojans behind some files and then send them to victim but remember, make sure to make it FUD so that antivirus doesn't block it.


Enjoy!!!

[Kulverstukas]

I cannot wrap my mind around this:

The last and the greatest, it doesn't increase the size of the file. That means, if you put a movie of 700MB behind a text file of 0KB, then after hiding the movie, you can check the size of the file, it'll be 0KB. I use this trick to carry more data on a USB than its capacity.

How can you cheat the format so much? it's not possible. Even though the file with ADS says it's 0KB you still can't put a 100GB file put into a txt of 0KB and carry that around in a 2GB flash drive.
It just doesn't work that way.

[p_2001]

I cannot wrap my mind around this:
How can you cheat the format so much? it's not possible. Even though the file with ADS says it's 0KB you still can't put a 100GB file put into a txt of 0KB and carry that around in a 2GB flash drive.
It just doesn't work that way.

yes, it doesn't... Maybe it's just the controller that reads wrong?
the most you can do is somehow utilize the recovery portions...

@paradox
.... Read about NAND drives and you'll see that this isn't possible.

[g00dhum0r]

2.) You can hide malwares, trojans behind some files and then send them to victim but remember, make sure to make it FUD so that antivirus doesn't block it.

This topic may be kind of old, but I figure I would ask this question, just in case someone else in the future has the same question.  It's cool that you can hide malware, etc. behind files and send them to others, but what is the best way to make them execute the hidden file?  If you send them an .exe attached to a .txt file, the exe wouldn't launch when they double click the txt file, correct?  So what is the best way?

[parad0x]

This topic may be kind of old, but I figure I would ask this question, just in case someone else in the future has the same question.  It's cool that you can hide malware, etc. behind files and send them to others, but what is the best way to make them execute the hidden file?  If you send them an .exe attached to a .txt file, the exe wouldn't launch when they double click the txt file, correct?  So what is the best way?

Yes, by double-clicking the file, the executable won't execute. You need to code a batch file that executes that virus/trojan/rootkit.

Code: (Batch) [Select]

start ./anything.txt:virus.exe


And you'll have to make an autorun file so that it executes own its own.


Let the name of the batch file is vir.bat

Code: [Select]

open=vir.bat

In this way, your virus will be executed automatically or you can social-engineer him to execute that virus.


That depends on you.

[ecence]

He I have a kind of error with this method.
 
When I move for example a folder with the hidden file "in" it to a USB-stick it says that some properties can't be copied on to the USB.
Can this be solved by another method or?

[edu19]

how to run a file that is an ADS of another one?
 
well first off, you need to transfer the file to the "victim" right?
 
Most if not all softwares for file sharing like P2P softwares, webbrowsers, etc doesnt preserve the stream, so this thing is useful more as a local issue rather than remote.
 
Nowadays most AVs will warn if there is an executable file streamed into another file and they can remove it.
 
So, in my opinion unfortunately this became something of the past unless you find a way to run the ADS. I used to have an "exploit" for some Windows program in which you clicked an element of the window and it would run the ADS. but again it is just local because the softwares remove the ADS.
 
It is nicer to make a chimera with a file, like hiding rogue code inside "safe" files.