5

We had a challenge today at our cybersec class, and at a point of time (in a Windows Machine via terminal) I found an interesting file with dir called root.txt

By more root.txt I got the output Look deeper..., which led me to try dir /a to see if something is hidden. However, no result.

After a while, the Prof. gave us a hint to use dir /r which had this output: 

..
05/24/2018  05:25 PM                14 root.txt
                                    137 root.txt:confidential.txt:$DATA
..

Someone found out that we can read confidential.txt using more < root.txt:confidential.txt

What exactly is happening here? And what does /r do?

bashbin
  • 415
  • 1
  • 7
  • 21

1 Answers1

5

NTFS stores a file as a collection of streams, which are also called NTFS "attributes". I prefer to use the name "stream" since "attribute" commonly refers to a file-attribute flag in a file's $STANDARD_INFORMATION stream, such as "hidden", "system", and "readonly". The two stream types that are commonly used directly by Windows programs are data and index (i.e. $DATA and $INDEX_ALLOCATION).

An NTFS file always has a default (anonymous) data stream, e.g. "filename::$DATA" or, more simply, just "filename". It can also have alternate (named) data streams, such as "filename:streamname:$DATA". A directory can have named data streams, but not a default one since its anonymous stream is the filename index. The /r option of CMD's dir command calls FindFirstStreamW and FindNextStreamW on each file or directory in a listing in order to list its $DATA streams.

An NTFS directory has a $FILE_NAME index that's named "$I30", e.g. "dirname:$I30:$INDEX_ALLOCATION". This index is also aliased anonymously, e.g. "dirname::$INDEX_ALLOCATION" or, more simply, just "dirname". It can be listed via FindFirstFile and FindNextFile.

Named indexes over other stream types are also possible. For example, an NTFS volume has reparse-point index in its reserved "$Reparse" directory at "\$Extend\$Reparse:$R:$INDEX_ALLOCATION". Listing this index requires a a specific directory query, so FindFirstFile can't be used. FindFirstVolumeMountPoint and FindNextVolumeMountPoint list this index in order to search for mount points on the volume, i.e. IO_REPARSE_TAG_MOUNT_POINT reparse points that target volume GUID paths.

Eryk Sun
  • 33,190
  • 5
  • 92
  • 111
  • the 30 in $I30, is because of I[NDEX_ALLOCATION] => 15 chars * 2 bytes each in UTF16LE = 30 – evandrix Jul 11 '19 at 11:20
  • @evandrix, funny, but no. An index over filenames is named "$I30" because it's an [I]ndex over the `$FILE_NAME` attribute, which is assigned the attribute type code 0x30. For a list of attribute type codes, see [`ATTRIBUTE_RECORD_HEADER`](https://learn.microsoft.com/en-us/windows/win32/devnotes/attribute-record-header). They didn't continue this scheme for the index over reparse points, else it would be named "$IC0" instead of "$R". – Eryk Sun Jul 11 '19 at 11:34
  • i so thought it would be yet another case like i18n or l10n :/ – evandrix Jul 12 '19 at 16:10