Hey everybody welcome to part three.
Going a little deeper into the windows module.
So in this particular video we're gonna be talking about alternate data streams.
So what are data streams in general.
They're also referred to as file streams so a data stream in a nutshell is a sequence of data or bytes
that is referenced based on a file.
So for example we have a file called test that team now from the LSD perspective.
If I wanted to get the data from that file I would access the data stream called data.
So in this particular case it's this right.
So there's a reason why nothing is in between here it's interpreted that nothing there is something
called the main streams.
So there's a sets of mainstream such as attribute underscore list data E.A. information bitmap.
So I'll link to some more details around those options and the standard ones above the video.
Now what I want to go through with you today is alternate data streams so these can be used in a variety
of different ways in some common uses for red teaming perspective.
It could be to hide data hide a file hide an executable entirely without it being noticed.
So let's quickly quickly create a file here so in the command that I know we haven't done the command
line videos yet.
However think of Echo as just me typing something in this into a file right or typing something in general
so do Red Team nation.
I'm going to put that into a file called Secret dot t t right.
So if you look on your right hand side on the desktop which is where I'm at we see red team nation.
Now if I want to view the text on the command line I would do type secret and we see the exact same
thing.
If I go in here and I add in or rocks right.
Come into here say that and then we print out the thing.
Now we can see graduation rocks which it does but so now we have the symbol text file with some dot
in it.
Now if we want to create a data stream let's say we want to hide some text and to some somebody doesn't
like red team nation blue then they want to hide a secret message for us to find.
So if we got out
so for one to be nefarious here.
So we send that over.
So we're setting it to secret.
However if we left this as is it would overwrite the text.
So we're going to give it an alternate data stream and we're gonna call it evil
so doing this we can see nothing changed on the file that still says Red Team rocks there's nothing
specific here that shows that anything has happened.
And if we view the text again nothing's wrong.
However if we view the ultimate data stream
right now we see red team nations sucks.
So we're gonna go ahead and change this back to rocks more exclamation points this time we're gonna
save it and close again if we look back in here we just see the one exclamation point which is our original
text
however if we view the data stream again after our change we see that we've permanently changed that
data stream so you can hide text of any kind and there could be.
Keep in mind this could be an image could be anything.
So we go ahead and delete the secrets right.
And we'll create a new one
we'll call it secret as well.
So you're to.
So again type secrets that we have.
Resignation again.
Same text.
So what I want to do now is I want to hide the let's say I want I want to hide an executable.
So I'm going to push out the output
of the calculator which keep in mind calculator is just this.
So we're just a calculator
and let's say we want to push the calculator or that could be malware could be whatever we want.
So I just happen to know that this is actually here.
Oh yeah.
That's not what we're looking for calc right.
So we're gonna push that into secret Dr. T.
We're gonna call it calc Daddy XY right.
Again we've put a whole executable in here but there's nothing nothing visible now quickly if we do
want to actually see if our data stream is present the DVR command which is the directory listing if
we look at it now we just see secret that text.
Right.
That's the only file in there.
But if we did a slash R with capital R we now see that we have our data stream there.
Now this is a quick way to do it.
If you happen to be in the same directory there are other tools such as streams from Microsoft Windows
essentials that will do the same thing there's plenty of third party tools as well.
But I'll let you view it.
But now you can see the full the full size of the file.
Now in previous versions of Windows to launch an executable from an alternate data stream we would just
do start secret
today.
See right this fails.
It does not know what to do with it.
This was this was patched by Microsoft a while back.
So there's a few alternatives going around.
So what we're gonna do is we're gonna do something good for files slash P We're gonna give it the windows
system 30 to
folder and we're gonna push in the pad that 60 and then we're going to pass in our file path.
So in this case its users administrators does top secret that 60 million new calc.
So this essentially allows us to bypass that patch that they put into place and allows us to execute
misspelled there.
It's not for file is for files sorry about that.
I grew up here.
Mr. Flagg.
So there's supposed to be a dash C or slash C in here on that poof.
Now we've got a calculator and we're running that off of an ultimate data stream here.
So what I want to challenge you guys to do is set up the same situation again all of the commands and
things that we we just did will be below the video.
Go ahead and find out different ways that you're able to execute a binary or an executable from an alternate
data stream in this particular case you can use calculator.
There's quite a few out there.
You'll find stuff around.
Power shell maybe play around with different ways to use alternate data strings.
Maybe it's just hiding text and then copying the file over to your to another machine e-mailing it to
another machine opening it back up and seeing if you can get the data off of the data string.
So go ahead and test a few things out see how it goes and then we'll see what you guys can come up with.