Windows File Pseudonyms

No ratings

Presented at ShmooCon 2011 by

In his presentations, “Windows File Pseudonyms,” Dan Crowley discussed some interesting quirks in path and filename routines found in Windows systems. Pointing out that, “One file can be referred to with many different filepaths; some are well known, and some are not,” he proceeded to show examples of what lesser known ways would be most apt to subvert security mechanisms. As Crowley began with DOS 8.3 naming conventions, he went on to show that file type may be determined based on user input in cases where the extension is determined by what follows the last dot. Examples of equivalent file paths were provided; discarding trailing characters, paths given Windows shell: file.txt, file.txt….., file.txt/././././” file.txt/././././“>file.txt/././././. and more. DOS special device files, CON, PRN, and COM1. The possibilities were seemingly endless. Although not practical for use against NTFS, Crowly did provide live demonstrations showing how these quirks can be used to “bypass filters and access control mechanisms, evade IDS detection, alter the way that files are handled and processed, and make brute force attacks to enumerate files easier.”