OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Windows file problem
From: Simple Nomad (thegnomeNMRC.ORG)
Date: Mon Oct 09 2000 - 08:59:23 CDT

It works on NT because of NTFS. The "problem" is NTFS streams. These have
been known and around for a while. They're talked about in Hacking
Exposed, and I believe sysinternals.com or someplace like that has a
utility to find them.

- Simple Nomad - "No rest for the Wicca'd" -
- thegnomenmrc.org - -
- thegnomerazor.bindview.com - www.nmrc.org razor.bindview.com -

On Fri, 6 Oct 2000 poeppingLOGICAL.CM.NU wrote:

> I don't know if this is a hole, or the file is going somewhere
> else, but here is what I found.
>
> create a directory i.e c:\tempfolder
>
> go into the folder and type dir (its empty)
>
> now type echo junk >> :myfile
>
> type dir again (its still empty)
>
> now find a copy of vi.exe for windows (its all I can find that can read
> and write these files) once you get vi.exe type vi :myfile and presto
> it loads the file, with the conent of "junk" you wrote to it.
>
> next type start . and you can see that windows explorer can't see it.
>
> and if you try to delete the file it doesn't work.
>
> So if someone wanted to, they could log onto a server/workstation and
> create a file that fills up the harddrive (assuming that it takes up
> space, haven't tried), And no one would see it, or be able to delete it.
>
>
> Am I mising something? or is this just a flaw in windows (tested on
> windows nt 4.0 doesn't seem to work on windows 98, but need to try
> creating the file with vi.exe)
>
>
>
> thanks,
> matt
> poeppingksni.net
>