> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/system-host-based-attacks/windows-vulnerabilities/windows-file-system-vulnerabilities.md).

# Windows File System Vulnerabilities

### Alternate Data Streams

* Alternate Data Streams (ADS) is an NTFS (New Technology File System) file attribute and was designed to provide compatibility with the MacOS HFS (Hierarchical File System).
* Any file created on an NTFS formatted drive will have two different forks/streams:
  * Data stream - Default stream that contains the data of the file.
  * Resource stream - Typically contains the metadata of the file.
* Attackers can use ADS to hide malicious code or executables in legitimate files in order to evade detection.
* This can be done by storing the malicious code or executables in the file attribute resource stream (metadata) of a legitimate file.
* This technique is usually used to evade basic signature based AVs and static scanning tools.

### Demo: Alternate Data Streams

open C:\ drive 

```
cd Desktop
notepad test.txt:secret.txt

```

```
move payload.exe C:\\Temp\
```

```
type payload.exe > windowslog.txt:winpeas.exe
```

```
start windowslog.txt:winpeas.exe
```

* it shows access denied
* then do the following(need administrator access)

```
cd \
cd Windows\System32
mlink wupdate.exe C:\Temp\windowslog.txt:winpeas.exe
```