Vulnerability Development mailing list archives

Re: Windows file problem


From: Simple Nomad <thegnome () NMRC ORG>
Date: Mon, 9 Oct 2000 08:59:23 -0500

It works on NT because of NTFS. The "problem" is NTFS streams. These have
been known and around for a while. They're talked about in Hacking
Exposed, and I believe sysinternals.com or someplace like that has a
utility to find them.

-         Simple Nomad          -     "No rest for the Wicca'd"     -
-      thegnome () nmrc org        -                                   -
-  thegnome () razor bindview com  - www.nmrc.org   razor.bindview.com -

On Fri, 6 Oct 2000 poepping () LOGICAL CM NU wrote:

      I don't know if this is a hole, or the file is going somewhere
else, but here is what I found.

create a directory i.e c:\tempfolder

go into the folder and type dir (its empty)

now type  echo junk >> :myfile

type dir again (its still empty)

now find a copy of vi.exe for windows (its all I can find that can read
and write these files)  once you get vi.exe  type vi :myfile  and presto
it loads the file, with the conent of "junk" you wrote to it.

next type start .  and you can see that windows explorer can't see it.

and if you try to delete the file it doesn't work.

So if someone wanted to, they could log onto a server/workstation and
create a file that fills up the harddrive (assuming that it takes up
space, haven't tried), And no one would see it, or be able to delete it.


Am I mising something? or is this just a flaw in windows (tested on
windows nt 4.0 doesn't seem to work on windows 98, but need to try
creating the file with vi.exe)



thanks,
matt
poepping () ksni net



Current thread: