Onderwerp: Creating a secret web site on IIS 5.x using Alternative Data Streams

** Inge Henriksen Security Advisory http://ingehenriksen.blogspot.com/ **

Creating a secret web site on IIS 5.x using Alternative Data Streams
--------------------------------------------------------------------

Using a little known feature of the Windows NT file system (NTFS) one can create a secret website, this website can not be detected without third party tools made specifically for it.

Confirmed Applications
Microsoft® Internet Information Server® V5.x and probably earlier versions.

Confirmed Platforms
Should work with all NT based Windows as long as the fil system is NTFS and not FAT. Does not work on Vista Beta 1 with IIS 6.

Technical Description
A NTFS file can contain a number of alternative data streams that bypasses the regular directory listing, the data in the alternative data does not even count when the number of free bytes left on the disk is calculated.

Proof of Concept
Start a console on the NT system in question and change directory to the web root(usually c:\inetpub\wwwroot\)
In the example we will use the help.gif file that is already in the directory, you can use any file though. Type "dir" and take notice of the number of free bytes left on the disk
Type "echo This is a hidden data stream > help.gif:hidden" , we have now created a hidden data stream called "hidden", the name of the stream can be anything if you just avoid some special characters
Type "dir" againm notice that even though we added data to the file in an alternative data stream the free bytes left on the disk is left unchanged
Open you web browser and type in" http://localhost/help.gif " and you should see the little icon just as it was before we added the alternative data stream
Now, type in " http://localhost/help.gif:hidden " and you will see the data in the alternative data stream "hidden", eg the text "This is a hidden data stream". In the example I have used text as data, but one could easily use binary data too.
If you want to read alternative data streams from the console, in our example you would use "more < help.gif:hidden"

If the Virtual Folder in question allows for execution, then we can also hide a executable file in help.gif and remotely execute it later:

Type "type c:\WINDOWS\NOTEPAD.EXE > help.gif:notepad.exe"
Open a web browser from a remote computer type in " http://myremoteserver/help.gif:notepad.exe " , the browser hangs as the executable does not end
Go back to your web server and open task manager and select to see process from all users on the process tab, you will se a prosess called "help.gif:notepad.exe" running. In this manner one could hide a trojan or backdoor inside any file as long as it res
ides in a Virtual Folder that allows for execution.


Links
http://lists.gpick.com/pages/NTFS_Al...ta_Streams.htm

Mitigation at the IIS server looks pretty straightforward.

URLScan in default configuration prevents access to ADS files, generating
the following log line:

Client at 10.1.1.100: URL contains sequence ':', which is disallowed.
Request will be rejected. Site Instance='1', Raw
URL='/myremoteserver/help.gif:secret'

So you should see accesses in the IIS logs if you don't run URLScan, and
failed attempts in the URLScan logs if you do run it.