Creating a benign text file:
attacker@victimecho "this is benign" > benign.txtGet-ChildItem
evil.txt file inside the
attacker@victimcmd '/c echo "this is evil" > benign.txt:evil.txt'
Note how the evil.txt file is not visible through the explorer - that is because it is in the alternate data stream now. Opening the benign.txt shows no signs of evil.txt. However, the data from evil.txt can still be accessed as shown below in the commandline -
Additionally, we can view the data in the notepad as well by issuing:
Note that powershell can also help finding alternate data streams:
Get-Item c:\experiment\evil.txt -Stream *Get-Content .\benign.txt -Stream evil.txt