Windows NTFS Alternate Data Streams
The purpose of this article is to explain the existence of alternate data streams in Microsoft Windows, demonstrate how to create them by compromising a machine using the Metasploit Framework, and then use freeware tools to easily discover these hidden files.
The first step is to understand what alternate data streams are, and how they can be a threat to your organizations. Then, a comprehensive demonstration will be completed, that compromises a remote machine with an exploit, provides a reverse shell, and allows one to hide files on the victim's machine. Finally, there will be a discussion of freeware tools that can be used to easily locate this activity and allow one to take steps to stop it. Let's begin.
