Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Creating an Alternate Data Stream
To see how easy this is, let's create a simple alternate data stream. Open Notepad and create a file called goodstuff.txt. Put a few words of text in it. Now create another Notepad file called badstuff.txt and put some text into it.
Now go to the command line and type this command:
Badstuff.txt>goodstuff.txt:malicious.txt
The > operator pipes the contents of badstuff.txt to malicious.txt and the colon (:) tells Windows to attach malicious.txt to goodstuff.text as an ADS. Any time you see an extra colon in a pathname, you can be pretty sure you're dealing with an alternate data stream.
That's it. You just created an ADS named malicious.txt, transferred the contents of badstuff.txt to malicious.txt, and attached it to goodstuff.txt. If you want to see your handiwork, type this:
notepad goodstuff.txt:malicious.txt
This command will open Notepad and display the contents of malicious.txt. Of course, to get to malicious.txt, you have to know the entire path, not just the name of the ADS file. If you don't know the name and path of the ADS, you can't find it with conventional tools.
If this looks like something that could be run from a simple script, you're right. Scripts can also be used to access information and run executables from ADS.