Bypassing Avast Sandbox Using Alternate Data Streaming

[daatdraqq]

Introduction

Alternate data stream is supported by NTFS systems to aid the Macintosh

Hierarchical File System (HFS) that uses resource forks to store icons and other

information from a file.

Basically using Alternate Data Stream, users can easily hide files that go

unnoticed by some system administrators. Alternate Data Strem gives you the ability

to inject / add file data into existing files without affecting their functionality and

size.

This whithepaper will start with the basic use of Alternate Data Stream and

therefore this whitepaper show how to bypass Avast Sandbox.

It is not the focus of this whitepaper how to bypass antivirus using public

knowledge. However, aims to circumvent protection system AvastSandBox.

As a test system we used the operating system WindowsXP service pack2. For

a remote administration program was used metasploit.

Any knowledge found in this whitepaper is used with educational purposes

only and the author is not responsable for damages caused to third parties with

knowledge of this whitepaper.

Thanks, W1ckerMan.

Download:

http://dl.packetstormsecurity.net/papers/bypass/bypass-avast.pdf

Edited October 30, 2012 by Nytro