PT0-001 · Question #156
During post-exploitation, a tester identifies that only system binaries will pass an egress filter and store a file with the following command: c…
The correct answer is B. Alternate data streams. The command stores a file inside an NTFS Alternate Data Stream hidden within calc.exe, exploiting the NTFS feature that allows data to be embedded in named streams invisible to standard directory listings.
Question
During post-exploitation, a tester identifies that only system binaries will pass an egress filter and store a file with the following command:
c: \creditcards.db>c:\winit\system32\calc.exe:creditcards.db Which of the following file system vulnerabilities does this command take advantage of?
Options
- AHierarchical file system
- BAlternate data streams
- CBackdoor success
- DExtended file system
How the community answered
(45 responses)- A4% (2)
- B93% (42)
- D2% (1)
Why each option
The command stores a file inside an NTFS Alternate Data Stream hidden within calc.exe, exploiting the NTFS feature that allows data to be embedded in named streams invisible to standard directory listings.
A hierarchical file system refers to the parent-child directory tree organization of a filesystem and does not describe the technique of embedding hidden named data streams within existing files.
NTFS Alternate Data Streams allow any file to carry additional hidden data streams referenced using the colon syntax (filename:streamname). The command redirects creditcards.db into a stream named 'creditcards.db' attached to calc.exe, making the data invisible to standard dir commands and Windows Explorer while allowing it to pass egress filters that only validate the host binary's recognized type. The data persists within the file system but is not discoverable without ADS-aware forensic tools.
'Backdoor success' is not a recognized filesystem vulnerability or feature and does not correspond to any specific filesystem mechanism being exploited by this command.
Extended file system (ext2/ext3/ext4) is a Linux filesystem type that lacks the NTFS Alternate Data Stream feature; this technique applies exclusively to Windows NTFS volumes.
Concept tested: NTFS Alternate Data Streams for data hiding
Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/b134f29a-6278-4f3f-904f-5e58a713d2c5
Topics
Community Discussion
No community discussion yet for this question.