Printable View
ADS, or Alternate Data Streams, is a not very well known feature of the NTFS file system. I still don't know very much about, one of my friends showed it to me the other day. Read about ADS here, does anyone know of this, or what it was intended for? If found it quite interesting, however seemingly pointless it is, I'm gonna mess with it, see what all I can do with it at my school.
ADS is a beautiful way of hiding stuff... Unless you know it exists, what it can do and how I can use it to help me exploit your system then it is a very useful way for someone to hide their exploitation of your system.
Google "LADS ADS" and read more.
Thanks, one last thing, can I use ADS to hide an entire directory, or just individual files?
I don't have NTFS at my house to test it on, just my Linux OS, I have to wait till I have free time at school to test it on my own(which probably won't happen for a while).
LaoTzu,
If you have a winxp or w2k install disk, you could use vmware workstation to run windows on your linux box, and try it out.
http://www.vmware.com/download/workstation.html
[EDIT]by the way, first result in google yielded this page:
http://www.heysoft.de/nt/ntfs-ads.htm
[/EDIT]Quote:
Can somebody add an ADS to a directory entry instead of a file?
Yes, it works the same way.
-ik
It was more or less put in for Mac support. We have some more details here:
http://www.antionline.com/showthread...ighlight=altds
[QUOTE] Originally posted here by Iron-Kurton
[B]LaoTzu,
If you have a winxp or w2k install disk, you could use vmware workstation to run windows on your linux box, and try it out.
http://www.vmware.com/download/workstation.html
[EDIT]by the way, first result in google yielded this page:
http://www.heysoft.de/nt/ntfs-ads.htm
[/EDIT]
But what I meant was this, would this work, hiding a directory in another direcotry or file using ads.
md dir1
cd dir1
echo stuffinfile>text1.txt
echo stuffinfile>text2.txt
cd ..
md dir2
type dir1>dir2:dir1 (or type dir1>notepad.exe:dir1)
Don't have the disk, but I can get them, I'll check out vmware workstation.
AFAIK ADS only works on files. ADS is used for Apple filesharing. Apple uses 2 streams to store data. One stream contains the actual file and the other stream is used to store information about that file (filetype i.e.).
Think about this again.... Type a directory? What's it going to type?Quote:
type dir1>dir2:dir1 (or type dir1>notepad.exe:dir1)