Windows NTFS Alternate Data Streams
by Don Parker
1. Introduction The purpose of this article is to explain the existence of alternate data streams in Microsoft Windows, demonstrate how to create them by compromising a machine using the Metasploit Framework, and then use freeware tools to easily discover these hidden files. The first step is to understand what alternate data streams are, and how they can be a threat to your organizations. Then, a comprehensive demonstration will be completed, that compromises a remote machine with an exploit, provides a reverse shell, and allows one to hide files on the victim's machine. Finally, there will be a discussion of freeware tools that can be used to easily locate this activity and allow one to take steps to stop it. Let's begin. 2. Alternate data streams explained Alternate data streams have been around since the introduction of NTFS in the Windows NT operating system. What are alternate data streams though? In essence they were created to provide compatibility with HFS, or the old Macintosh Hierarchical File System. The way that the Macintosh's file system works is that they will use both data and resource forks to store their contents. The data fork is for the contents of the document while the resource fork is to identify file type and other pertinent details. To this day the existence of alternate data streams is not widely known. However they have been in use by some nefarious individuals in the security community for some time. Whenever something of value is found to further the agenda of malicious hackers and others with ill intent, you can rest assured it will be quickly adopted. There has been a marked increase in the use of these streams by malicious hackers wanting to store their files once they have compromised a computer. Not only that, it has also been seen that viruses and other types of malware are being placed there as well. The crux of the matter is that these streams will not be revealed using normal viewing methods, whether via a command prompt or using the Windows Explorer. How are these statements corroborated? After an incident has occurred and a computer has been compromised, forensic investigators may be involved. It is based on these findings that the upsurge in the use of alternate data streams has been noted. Even though a corporate entity is well protected, not all anti-virus products in their default configuration will pick up alternate data streams. Most anti-virus products now do find these streams, but only with changes made to the default configuration. 3. Demonstration How does one put all this information about alternate data streams and their danger into context? To really understand the risk, it is helpful to actually do it for yourself, or at least see a demonstration. To that end, in this article the reader will first gain system level access on a remote computer courtesy of the Metasploit Framework. In actuality, for the purpose of this article it won't really be a remote computer, but one in a lab that was used to create our test environment. The end result is the same, however. One doesn't need to send the attack through the Internet to a remote computer to prove that it can be done. Most exploits will create their own socket and build the packets themselves. So in reality, the exploit payload will get there regardless -- because it has a valid IP, and TCP or UDP header built for it by the exploit code. In this demonstration we will break into a computer using the Metasploit Framework. The specific exploit I will use is the MS04-011 vulnerability, also known as the lsass overflow in Metasploit. From there the TFTP protocol will be used to transfer over some files, which could be found in a "survey kit." After that, these tools will be put into the alternate data streams of existing files found on that computer, to clearly show what can be done. Once this is completed, the command line scanner that was transferred over to the compromised computer will be remotely executed, and a scan will take place to look for other possible internal computers. H.D. Moore, one of the co-authors of the Metasploit Framework, has seeded the exploit with the ASCII string "METASPLOIT". One can surmise that this was done so that the IDS vendors would be able to write a signature for his tool. Please see the packet from the attack, as shown below, to illustrate this point.
Note that 192.168.1.102 is the attacking computer using the Metasploit Framework, and that 192.168.1.101 is the victim computer running Windows 2000 Professional. The W2K install is a fresh install with no patches or service packs applied, for demonstration purposes. Please note that for alternate data streams to be useful in the wild, there still needs to be an attack vector with an exploitable vulnerability. An unpatched Windows 2000 machine is used in this case purely for demonstration purposes; in real life, a patched system would require a different exploit to be effective. We will see below that the attack has been successful. Our attacking machine now has a reverse shell given to it by the victim. Port 4321 is the default port when using the lsass exploit within Metasploit. It can, however, be changed.
At this point, the transfer of files from the attacker to the compromised computer should begin. This is done via the TFTP protocol. Note the command as it was entered into the reverse shell, telling the victim machine to TFTP over the file ipeye.exe.
These TFTP file transfers from the attacking computer to the victim computer continue until we have four files transferred in total: ipeye.exe, psexec.exe, pslist.exe, and klogger.exe. For brevity I have not shown the successive packet transfers. Listed below is a directory listing from the victim host, once all files are there. These are shown in the directory c:\compaq\.
Seen below, we see how the attacker deletes the "tftp780" file in that directory. This would be consistent with wiping evidence.
The attacker now puts the executable ipeye.exe into an alternate data stream associated with the existing file test_file The syntax to do this is as follows:
Now this same process is completed for the three other remaining files that were transferred to the compromised host. They are copied over into an alternate data stream of an existing file on the victim computer. You can also copy a file into the stream of a directory as well, such as simply C:\. We will then run psexec.exe on the victim computer in order to execute the command line scanner ipeye.exe, which is in the alternate data stream c:\Compaq\test_file:ipeye.exe. Please note that I used the copy of psexec.exe which is not in the alternate data stream, but rather the one sitting clearly visible in the directory. Please note that there are a variety of ways to start tools or programs on a Win32 based computer. Another way to initiate a process would be to use the "start" command -- which would in fact be simpler, and would not leave a fill in clear view on the victim's machine. Some hackers may instead use a batch file to start a program, or other means as well. In fact the modus operandi of a hacker may not always be clear, but we do need to remember that not all hackers are created equal. Many a hacker has been noted via a honeynet making questionable moves. The reason psexec.exe was chosen for this article is simply because that suite of tools, freeware offered by Sysinternals, is one favoured by hackers. In an effort to impart some realism to this article I decided to use tools that you may very well see in a computer forensic investigation. With that in hand lets continue with the packet below.
We saw above that the command as issued was as follows:
The command line scanner tool was transferred over as part of a "survey kit" which is often used by hackers to further their exploitation of a network. Note that in the laboratory I actually have another computer listening on 192.168.1.100 and it has port 139 open. As a hacker coming in from the outside, however, I would need to simply use one of the reserved IP address ranges and start scanning to find this computer.
We can see from the above packets that the execution of the command line scanner hidden within the alternate data stream was successful. It reported back to us that port 139 was indeed open on the machine it scanned. Since I know for a fact that this computer is in my lab, I am able to corroborate the results. This process illustrates the usage that such a stream could have for malicious hackers. One needs to realize that employees of a company could also potentially hide such undesirable content as pornography, both legal and illegal, in such a place. 4. Fixing the problem Now we'll look at some output from several alternate data streams discovery tools. Both before and after output will be demonstrated, so that one will see that there were no alternate data streams prior to the hack, and also see that they do in fact exist after the attack has been completed. Both these tools have been used to make sure that they both picked up the presence of these streams, and to confirm the results of our demonstration. How do you deal with the problem of alternate data streams? There are some excellent tools that been written by a few talented developers like Frank Heyne, and Arne Vidstrom which will detect alternate data streams. In the interest again of visually showing what these streams are and how they can appear once detected, a screenshot of before and after will be shown. The tools lads and lns were used to look for the streams on the Windows 2000 machine, both before and after the hack. Shown below is the output from each tool on our machine with a fresh install of W2K.
As expected, nothing was found on the computer. Now take a look at the output below to see what is detected by these tools once some remote work has been done on the victim computer.
As shown in the above output, it is clear that the alternate data streams created in this article were picked up by our two tools. By using these freeware tools you can easily find out if you have these streams existing on your computers. It is highly advised that one complete this search on a semi-regular basis. While some anti-virus vendors will now pick up these streams, one may prefer to rely on a tool that was designed solely to find them. 5. Conclusion Alternate data streams for Windows NTFS is a real threat -- however, that threat can be minimized through good security practices, including a standard defense-in-depth approach to network security. Additionally, it has been shown how two freeware tools can be used to scan and identify the presence of alternate data streams, thereby alerting the administrator to the threat and giving him time to deal with it in an appropriate manner. Please remember that the test system used in this case was an unpatched Windows 2000 machine; to do this process on a patched machine, it would require a different exploit as an entry point into the machine -- and only then would the alternate data stream approach be successful. The author welcomes email with any comments or feedback you may have. | |||||||||||||
 About the author Don Parker is an Intrusion Detection Specialist who holds the GCIA certification. He works as an independent consultant and instructor. He also provides other computer security services of a highly specialized nature. View more articles by Don Parker on SecurityFocus. |
This article originally appeared on SecurityFocus.com -- reproduction in whole or in part is not allowed without expressed written consent.