{"id":6456,"date":"2019-06-21T22:18:29","date_gmt":"2019-06-21T22:18:29","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=6456"},"modified":"2019-06-21T22:18:31","modified_gmt":"2019-06-21T22:18:31","slug":"definedosdevice-symbolic-link-trick","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2019\/06\/21\/definedosdevice-symbolic-link-trick\/","title":{"rendered":"DefineDosDevice symbolic link trick"},"content":{"rendered":"\n<p>I don&#8217;t know who is the original author of this trick &#8211; I saw it being used by some malware a few years ago and it was also discussed on <a href=\"https:\/\/www.kernelmode.info\/forum\/viewtopic.php?f=16&amp;t=23&amp;start=80\">KernelMode forum<\/a>, and <a href=\"https:\/\/stackoverflow.com\/questions\/48526904\/how-can-this-code-generate-a-file-with-a-filename-containing-a-colon-on-windows\">StackOverflow<\/a>. Reading McAfee&#8217;s paper about <a href=\"https:\/\/securingtomorrow.mcafee.com\/other-blogs\/mcafee-labs\/in-ntdll-i-trust-process-reimaging-and-endpoint-security-solution-bypass\/\">Process Reimaging<\/a> I suddenly remembered it. <\/p>\n\n\n\n<p>How does it work?<\/p>\n\n\n\n<p>With a <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/desktop\/api\/fileapi\/nf-fileapi-definedosdevicew\">DefineDosDevice<\/a> API (the same API that is used by the <em>subst<\/em> command) we can create a new MSDOS device name. We can map it to a new, non-existing file path. The main executable can be then moved to that new space (i.e. new path the space is mapped to). <\/p>\n\n\n\n<p>This little trick makes the original file &#8216;disappear&#8217; from the system. Most of the process listing tools continue to map the running process to its original path, yet any attempts to access properties of the file itself end up with nothing. This is because the process is running, but the file it was launched from is &#8216;not there&#8217; anymore:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/06\/DefineDosDevice3.png\"><img decoding=\"async\" loading=\"lazy\" width=\"372\" height=\"171\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/06\/DefineDosDevice3.png\" alt=\"\" class=\"wp-image-6459\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/06\/DefineDosDevice3.png 372w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/06\/DefineDosDevice3-300x138.png 300w\" sizes=\"(max-width: 372px) 100vw, 372px\" \/><\/a><\/figure>\n\n\n\n<p>Let&#8217;s examine it step by step:<\/p>\n\n\n\n<ul><li>Create a <em>foobar<\/em> namespace using DefineDosDevice and point it to <em>\\??\\c:\\test\\test_hidden.exe<\/em>.<\/li><li>Move the current process&#8217; file e.g. <em>c:\\test\\test.exe<\/em> to <em>\\.\\foobar<\/em>.<\/li><\/ul>\n\n\n\n<p>That&#8217;s it.<\/p>\n\n\n\n<p>In my test case I just renamed <em>test.exe<\/em> to <em>test_hidden.exe<\/em>, still inside the <em>c:\\test<\/em>. It could be any location really, including very deeply nested directories that may be harder to inspect w\/o forensic tools.<\/p>\n\n\n\n<p>To find such mapping, one has to use tools like WinObj &#8211; it shows the DosDevice called <em>foobar<\/em> that points to the <em>.exe<\/em>:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" loading=\"lazy\" width=\"737\" height=\"306\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/06\/DefineDosDevice.png\" alt=\"\" class=\"wp-image-6457\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/06\/DefineDosDevice.png 737w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/06\/DefineDosDevice-300x125.png 300w\" sizes=\"(max-width: 737px) 100vw, 737px\" \/><\/figure>\n\n\n\n<p>One can also launch it via <em>\\\\.\\foobar<\/em> (need a dedicated tool tho).<\/p>\n\n\n\n<p>And if you are wondering what Sysmon will see when we launch such hidden file &#8211; luckily, it will link to a proper image on the drive:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" loading=\"lazy\" width=\"294\" height=\"199\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/06\/DefineDosDevice2.png\" alt=\"\" class=\"wp-image-6458\"\/><\/figure>\n\n\n\n<p>Last, but not least &#8211; we can create a space that maps to Alternate Data Stream too \ud83d\ude42 e.g. <em>\\??\\c:\\test\\test.exe:hidden<\/em>. In such case, a <em>copy<\/em> command can be used to copy files to such newly-created space\/location e.g.:<\/p>\n\n\n\n<ul><li>copy test.exe \\\\.\\foobar<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>I don&#8217;t know who is the original author of this trick &#8211; I saw it being used by some malware a few years ago and it was also discussed on KernelMode forum, and StackOverflow. Reading McAfee&#8217;s paper about Process Reimaging &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2019\/06\/21\/definedosdevice-symbolic-link-trick\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,53,9],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6456"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=6456"}],"version-history":[{"count":2,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6456\/revisions"}],"predecessor-version":[{"id":6461,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6456\/revisions\/6461"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=6456"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=6456"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=6456"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}