Skip to content

Instantly share code, notes, and snippets.

@diyinfosec

diyinfosec/ntfs_ads_limit_test.ps1

Created February 3, 2022 18:07
Show Gist options
  • Save diyinfosec/78a714edfd6965cf404844cae8786278 to your computer and use it in GitHub Desktop.
Save diyinfosec/78a714edfd6965cf404844cae8786278 to your computer and use it in GitHub Desktop.
Download ZIP
Testing the number of possible Alternate Data Streams for a file in NTFS.
Raw
ntfs_ads_limit_test.ps1
#- Iterate over the maximum size of Attribute ID
for($i=1; $i -lt 65536; $i++)
{
#- This file must already exist. Additional hardlinks will be created for this file.
$original_file_name="file.txt";
#- Testing the upper limit for ADS creation, breaking off once there is an non-terminating error [Set-Content : Could not open the alternate data stream ‘<stream_name>’ of the file]
#- Non-terminating errors are not handled using try/catch. To force a non-terminating error to be caught we use "-ErrorAction Stop"
try
{
#- Creating ADS for a file
Set-Content -Path 'myfile.txt' -Stream $i -Value 'test';
}
catch
{
Write-Error "";
Write-Output "Error occured when trying to create ADS number $i";
break;
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment