{"id":377,"date":"2012-10-16T21:19:05","date_gmt":"2012-10-16T19:19:05","guid":{"rendered":"https:\/\/www.asafety.fr\/?p=377"},"modified":"2015-11-11T00:45:33","modified_gmt":"2015-11-10T22:45:33","slug":"les-dossiers-speciaux-et-le-stockage-de-fichiers-invisibles","status":"publish","type":"post","link":"https:\/\/www.asafety.fr\/en\/administration-reseaux-et-systemes\/les-dossiers-speciaux-et-le-stockage-de-fichiers-invisibles\/","title":{"rendered":"Les dossiers sp\u00e9ciaux et le stockage de fichiers invisibles"},"content":{"rendered":"

<\/p>\n

Dans tous\u00a0environnements\u00a0Windows il y a des dossiers que l’on peut qualifier de “sp\u00e9ciaux”. Ces dossiers sont\u00a0r\u00e9guli\u00e8rement\u00a0repr\u00e9sent\u00e9s par une ic\u00f4ne sp\u00e9cifique, comme c’est le cas de la Corbeille avec sa petite poubelle, ou encore le dossier des favoris du navigateur avec une \u00e9toile.<\/p>\n

D\u2019autres dossiers, quant \u00e0 eux, disposent de fonctionnalit\u00e9s diff\u00e9rentes. C’est le cas du dossier “Fonts” se trouvant dans “C:\\Windows\\Fonts” et qui contient toutes les polices d’\u00e9criture du syst\u00e8me. Lorsqu’un fichier est coll\u00e9 au sein de ce dossier, Windows tente automatiquement d’installer la nouvelle police. A noter qu’il n’est pas possible via l’explorateur de cr\u00e9er des dossier par exemple dans ce r\u00e9pertoire sp\u00e9cial.<\/p>\n

\"Le<\/a>

Le dossier sp\u00e9cial “fonts”<\/p><\/div>\n

Mais qu’en est t’il d’un acc\u00e8s \u00e0 ce dossier par le biais d’un terminal?<\/p>\n

\"Acc\u00e8s<\/a>

Acc\u00e8s au dossier “fonts” par un terminal<\/p><\/div>\n

La figure pr\u00e9c\u00e9dente montre bien l’acc\u00e8s au dossier des “fonts” par le biais d’un terminal, dans lequel toutes les op\u00e9rations usuelles sont fonctionnelles (cr\u00e9ation de dossier, de fichier…). Or toutes les modifications effectu\u00e9es dans ce dossier ne s’av\u00e8rent pas visibles dans l’explorateur. En effet, les dossiers cr\u00e9\u00e9s n’apparaissent pas et leur acc\u00e8s direct par la barre d’adresse de l’explorer n’am\u00e8ne \u00e0 rien (Windows 7).<\/p>\n

De tels r\u00e9pertoires disposant de propri\u00e9t\u00e9s similaires au dossier “fonts” il en existe une multitude sur un environnement Windows. Chaque r\u00e9pertoire est li\u00e9 \u00e0 une ressource sp\u00e9ciale dans l’environnement graphique, \u00e0 un ic\u00f4ne sp\u00e9cial et \u00e0 une cl\u00e9 d’identification unique dans le registre.<\/p>\n

Il suffit pour un nouveau r\u00e9pertoire avec un nom quelconque, d’\u00eatre suffix\u00e9 d’un point puis d’une cl\u00e9 du registre d\u00e9finie entre accolade pour devenir un r\u00e9pertoire “sp\u00e9cial”. Mais quels sont ces cl\u00e9s et vers quelles ressources pointent-elles?<\/p>\n

Pour synth\u00e9tiser et centraliser en guise d’exemple plusieurs de ces dossiers sp\u00e9ciaux, voici un script Batch qui permet la cr\u00e9ation de 120 d’entre eux :<\/p>\n

[bash]&lt;\/p&gt;
\n&lt;p&gt;@echo off&lt;br \/&gt;
\nset \/p folder=Indicate a folder prefix :&lt;br \/&gt;
\necho 1] network and internet connections&lt;br \/&gt;
\nmd %folder%.{7007ACC7-3202-11D1-AAD2-00805FC1270E}&lt;br \/&gt;
\necho 2] a media clip&lt;br \/&gt;
\nmd %folder%.{00022601-0000-0000-C000-000000000046}&lt;br \/&gt;
\necho 3] a video clip&lt;br \/&gt;
\nmd %folder%.{00022602-0000-0000-C000-000000000046}&lt;br \/&gt;
\necho 4] MIDI Sequence&lt;br \/&gt;
\nmd %folder%.{00022603-0000-0000-C000-000000000046}&lt;br \/&gt;
\necho 5] taskbar and start menu properties&lt;br \/&gt;
\nmd %folder%.{0DF44EAA-FF21-4412-828E-260A8728E7F1}&lt;br \/&gt;
\necho 7] scheduled tasks icon&lt;br \/&gt;
\nmd %folder%.{148BD52A-A2AB-11CE-B11F-00AA00530503}&lt;br \/&gt;
\necho 8] windows search&lt;br \/&gt;
\nmd %folder%.{1f4de370-d627-11d1-ba4f-00a0c91eedba}&lt;br \/&gt;
\necho 9] network places&lt;br \/&gt;
\nmd %folder%.{208D2C60-3AEA-1069-A2D7-08002B30309D}&lt;br \/&gt;
\necho 10] my computer&lt;br \/&gt;
\nmd %folder%.{20D04FE0-3AEA-1069-A2D8-08002B30309D}&lt;br \/&gt;
\necho 11] control panel&lt;br \/&gt;
\nmd %folder%.{21EC2020-3AEA-1069-A2DD-08002B30309D}&lt;br \/&gt;
\necho 12] printers and faxes&lt;br \/&gt;
\nmd %folder%.{2227A280-3AEA-1069-A2DE-08002B30309D}&lt;br \/&gt;
\necho 13] an html document&lt;br \/&gt;
\nmd %folder%.{25336920-03F9-11CF-8FD0-00AA00686F13}&lt;br \/&gt;
\necho 14] search icon&lt;br \/&gt;
\nmd %folder%.{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}&lt;br \/&gt;
\necho 15] help and support icon&lt;br \/&gt;
\nmd %folder%.{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}&lt;br \/&gt;
\necho 16] a lock icon&lt;br \/&gt;
\nmd %folder%.{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}&lt;br \/&gt;
\necho 17] run icon&lt;br \/&gt;
\nmd %folder%.{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}&lt;br \/&gt;
\necho 18 opens your browser&lt;br \/&gt;
\nmd %folder%.{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}&lt;br \/&gt;
\necho 19 opens outlook&lt;br \/&gt;
\nmd %folder%.{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}&lt;br \/&gt;
\necho 20] properties icon&lt;br \/&gt;
\nmd %folder%.{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}&lt;br \/&gt;
\necho 21] network setup wizard&lt;br \/&gt;
\nmd %folder%.{2728520d-1ec8-4c68-a551-316b684c4ea7}&lt;br \/&gt;
\necho 22] MHTML document&lt;br \/&gt;
\nmd %folder%.{3050F3D9-98B5-11CF-BB82-00AA00BDCE0B}&lt;br \/&gt;
\necho 23] html application&lt;br \/&gt;
\nmd %folder%.{3050f4d8-98B5-11CF-BB82-00AA00BDCE0B}&lt;br \/&gt;
\necho 24] unknown filetype&lt;br \/&gt;
\nmd %folder%.{30D02401-6A81-11d0-8274-00C04FD5AE38}&lt;br \/&gt;
\necho 25] wireless network setup wizard&lt;br \/&gt;
\nmd %folder%.{3c5c43a3-9ce9-4a9b-9699-2ac0cf6cc4bf}&lt;br \/&gt;
\necho 26] my documents&lt;br \/&gt;
\nmd %folder%.{450D8FBA-AD25-11D0-98A8-0800361B1103}&lt;br \/&gt;
\necho 27] XMl document&lt;br \/&gt;
\nmd %folder%.{48123bc4-99d9-11d1-a6b3-00c04fd91555}&lt;br \/&gt;
\necho 30] recycle bin full&lt;br \/&gt;
\nmd %folder%.{5ef4af3a-f726-11d0-b8a2-00c04fc309a4}&lt;br \/&gt;
\necho 31] FTP&lt;br \/&gt;
\nmd %folder%.{63da6ec0-2e98-11cf-8d82-444553540000}&lt;br \/&gt;
\necho 32] empty recycle bin&lt;br \/&gt;
\nmd %folder%.{645FF040-5081-101B-9F08-00AA002F954E}&lt;br \/&gt;
\necho 33] installation cd icon&lt;br \/&gt;
\nmd %folder%.{67cf8cbd-e5c0-44f7-9de5-e1d599d626d8}&lt;br \/&gt;
\necho 34 looks like its where browser plugins are kept&lt;br \/&gt;
\nmd %folder%.{692F0339-CBAA-47e6-B5B5-3B84DB604E87}&lt;br \/&gt;
\necho 35] folder options&lt;br \/&gt;
\nmd %folder%.{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}&lt;br \/&gt;
\necho 36] network and internet connections&lt;br \/&gt;
\nmd %folder%.{7007ACC7-3202-11D1-AAD2-00805FC1270E}&lt;br \/&gt;
\necho 38] clipboard icon&lt;br \/&gt;
\nmd %folder%.{72ADFD4B-2C39-11D0-9903-00A0C91BC942}&lt;br \/&gt;
\necho 77] system restore icon&lt;br \/&gt;
\nmd %folder%.{7325c922-bb81-47b0-8b2f-a5f8605e242f}&lt;br \/&gt;
\necho 78] wordpad document&lt;br \/&gt;
\nmd %folder%.{73FDDC80-AEA9-101A-98A7-00AA00374959}&lt;br \/&gt;
\necho 79] unknown folder type&lt;br \/&gt;
\nmd %folder%.{750fdf0f-2a26-11d1-a3ea-080036587f03}&lt;br \/&gt;
\necho 80] user accounts&lt;br \/&gt;
\nmd %folder%.{7A9D77BD-5403-11d2-8785-2E0420524153}&lt;br \/&gt;
\necho 81] scheduled tasks&lt;br \/&gt;
\nmd %folder%.{7BD29E00-76C1-11CF-9DD0-00A0C9034933}&lt;br \/&gt;
\necho 82] [internet explorer installation like activex] icon&lt;br \/&gt;
\nmd %folder%.{8369AB20-56C9-11D0-94E8-00AA0059CE02}&lt;br \/&gt;
\necho 83] briefcase&lt;br \/&gt;
\nmd %folder%.{85BBD920-42A0-1069-A2E4-08002B30309D}&lt;br \/&gt;
\necho 84] IE&lt;br \/&gt;
\nmd %folder%.{871C5380-42A0-1069-A2EA-08002B30309D}&lt;br \/&gt;
\necho 85] zip folder&lt;br \/&gt;
\nmd %folder%.{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}&lt;br \/&gt;
\necho 86] internet explorer installations like activex&lt;br \/&gt;
\nmd %folder%.{88C6C381-2E85-11D0-94DE-444553540000}&lt;br \/&gt;
\necho 87] unknown folder icon&lt;br \/&gt;
\nmd %folder%.{8E6E6079-0CB7-11d2-8F10-0000F87ABD16}&lt;br \/&gt;
\necho 88] network and internet connections&lt;br \/&gt;
\nmd %folder%.{992CFFA0-F557-101A-88EC-00DD010CCC48}&lt;br \/&gt;
\necho 89] lock icon&lt;br \/&gt;
\nmd %folder%.{9B0EFD60-F7B0-11D0-BAEF-00C04FC308C9}&lt;br \/&gt;
\necho 90] restore icon&lt;br \/&gt;
\nmd %folder%.{9DB7A13C-F208-4981-8353-73CC61AE2783}&lt;br \/&gt;
\necho 91] mail icon&lt;br \/&gt;
\nmd %folder%.{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}&lt;br \/&gt;
\necho 92] desktop icon&lt;br \/&gt;
\nmd %folder%.{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}&lt;br \/&gt;
\necho 93] search icon&lt;br \/&gt;
\nmd %folder%.{A9B48EAC-3ED8-11d2-8216-00C04FB687DA}&lt;br \/&gt;
\necho 94] unknown filetype&lt;br \/&gt;
\nmd %folder%.{ADB9F5A4-E73E-49b8-99B6-2FA317EF9DBC}&lt;br \/&gt;
\necho 95] unknown folder type&lt;br \/&gt;
\nmd %folder%.{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}&lt;br \/&gt;
\necho 96] favorites&lt;br \/&gt;
\nmd %folder%.{B005E690-678D-11d1-B758-00A0C90564FE}&lt;br \/&gt;
\necho 97] are unknown file type&lt;br \/&gt;
\nmd %folder%.{B12AE898-D056-4378-A844-6D393FE37956}&lt;br \/&gt;
\necho 98] are unknown file type&lt;br \/&gt;
\nmd %folder%.{B50F5260-0C21-11D2-AB56-00A0C9082678}&lt;br \/&gt;
\necho 99] are unknown file type&lt;br \/&gt;
\nmd %folder%.{B7BBD408-F09C-4aa8-B65E-A00B8FE0F0B9}&lt;br \/&gt;
\necho 100] are unknown file type&lt;br \/&gt;
\nmd %folder%.{B96D2802-4B41-4bc7-A6A4-55C5A12268CA}&lt;br \/&gt;
\necho 101] are unknown file type&lt;br \/&gt;
\nmd %folder%.{BD84B380-8CA2-1069-AB1D-08000948F534}&lt;br \/&gt;
\necho 102] webfolders&lt;br \/&gt;
\nmd %folder%.{BDEADF00-C265-11d0-BCED-00A0C90AB50F}&lt;br \/&gt;
\necho 103] are unknown file type&lt;br \/&gt;
\nmd %folder%.{c79d1575-b8c6-4862-a284-788836518b97}&lt;br \/&gt;
\necho 104] fonts folder&lt;br \/&gt;
\nmd %folder%.{D20EA4E1-3957-11d2-A40B-0C5020524152}&lt;br \/&gt;
\necho 105] admin settings&lt;br \/&gt;
\nmd %folder%.{D20EA4E1-3957-11d2-A40B-0C5020524153}&lt;br \/&gt;
\necho 106] bitmap image&lt;br \/&gt;
\nmd %folder%.{D3E34B21-9D75-101A-8C3D-00AA001A1652}&lt;br \/&gt;
\necho 107] add network place wizard&lt;br \/&gt;
\nmd %folder%.{D4480A50-BA28-11d1-8E75-00C04FA31A86}&lt;br \/&gt;
\necho 108] scheduled tasks&lt;br \/&gt;
\nmd %folder%.{D6277990-4C6A-11CF-8D87-00AA0060F5BF}&lt;br \/&gt;
\necho 109] opens up search&lt;br \/&gt;
\nmd %folder%.{e17d4fc0-5564-11d1-83f2-00a0c90dc849}&lt;br \/&gt;
\necho 110] scanners and cameras&lt;br \/&gt;
\nmd %folder%.{E211B736-43FD-11D1-9EFB-0000F8757FCD}&lt;br \/&gt;
\necho 111] zip folder&lt;br \/&gt;
\nmd %folder%.{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}&lt;br \/&gt;
\necho 112] policy package&lt;br \/&gt;
\nmd %folder%.{ecabaebd-7f19-11d2-978E-0000f8757e2a}&lt;br \/&gt;
\necho 113] my docments&lt;br \/&gt;
\nmd %folder%.{ECF03A32-103D-11d2-854D-006008059367}&lt;br \/&gt;
\necho 114] are unknown file type&lt;br \/&gt;
\nmd %folder%.{EFA24E61-B078-11d0-89E4-00C04FC9E26E}&lt;br \/&gt;
\necho 115] are unknown file type&lt;br \/&gt;
\nmd %folder%.{EFA24E62-B078-11d0-89E4-00C04FC9E26E}&lt;br \/&gt;
\necho 116] are unknown file type&lt;br \/&gt;
\nmd %folder%.{EFA24E63-B078-11d0-89E4-00C04FC9E26E}&lt;br \/&gt;
\necho 117] another unknown folder type&lt;br \/&gt;
\nmd %folder%.{effc2928-37b1-11d2-a3c1-00c04fb1782a}&lt;br \/&gt;
\necho 118] XML document&lt;br \/&gt;
\nmd %folder%.{f5078f28-c551-11d3-89b9-0000f81fe221}&lt;br \/&gt;
\necho 119] an unknown folder type&lt;br \/&gt;
\nmd %folder%.{F5175861-2688-11d0-9C5E-00AA00A45957}&lt;br \/&gt;
\necho 120] scanner and cameras&lt;br \/&gt;
\nmd %folder%.{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}&lt;br \/&gt;
\necho 121] internet explorer&lt;br \/&gt;
\nmd %folder%.{FBF23B42-E3F0-101B-8488-00AA003E56F8}&lt;br \/&gt;
\necho 122] scheduled tasks&lt;br \/&gt;
\nmd %folder%.{FF393560-C2A7-11CF-BFF4-444553540000}&lt;br \/&gt;
\npause&lt;\/p&gt;
\n&lt;p&gt;[\/bash]<\/p>\n

Il suffit d’indiquer un pr\u00e9fixe pour chaque nom de dossier (facultatif) comme par exemple “test” et l’ensemble des 120 dossier sp\u00e9ciaux seront cr\u00e9\u00e9s (dans les exemples qui suivent seulement 79 sont cr\u00e9\u00e9s car disposant des r\u00e9f\u00e9rences dans le registre). Le script pr\u00e9c\u00e9dent dispose des 120 cl\u00e9s propre \u00e0 chaque type de dossier avec la description de la ressource point\u00e9e.<\/p>\n

Une fois ces dossiers cr\u00e9\u00e9s, ceux-ci ont leur ic\u00f4ne sp\u00e9ciale. Certains d’entre eux n’affichent que le pr\u00e9fixe “test” sans la cl\u00e9, comme c’est le cas sous Windows XP :<\/p>\n

\"Les<\/a>

Les dossiers sp\u00e9ciaux cr\u00e9\u00e9s sous Windows XP<\/p><\/div>\n

C’est encore plus visible sous Windows 7 (et 8) :<\/p>\n

\"Les<\/a>

Les dossiers sp\u00e9ciaux cr\u00e9\u00e9s sous Windows 7<\/p><\/div>\n

Chaque dossier \u00e0 ses sp\u00e9cificit\u00e9s. Certains sont accessible en double cliquant dessus, d’autres redirigent vers une ressource du syst\u00e8me (le panneau de configuration par exemple) et d’autres lancent une application associ\u00e9s.<\/p>\n

Dans tous les cas, tous ces dossiers “sp\u00e9ciaux” s’accordent \u00e0 \u00eatre utilis\u00e9s comme de simple dossier au travers d’un terminal. Il est possible de cr\u00e9er des sous-dossiers et des fichiers dans chacun d’eux au travers de la console. En guise d’exemple, testons avec le dossier “test.{2227A280-3AEA-1069-A2DE-08002B30309D}” qui pointe vers la ressource des “Imprimantes et t\u00e9l\u00e9copieurs” \u00a0de Windows.<\/p>\n

En double cliquant sur ce dossier, on atteint :<\/p>\n

\"Ressource<\/a>

Ressource “Imprimantes et t\u00e9l\u00e9copieurs” via l’explorer.Exe<\/p><\/div>\n

En passant par le terminal :<\/p>\n

\"Ressource<\/a>

Ressource “Imprimantes et t\u00e9l\u00e9copieurs” via le terminal<\/p><\/div>\n

Pour conclure, l’ensemble de ses dossiers permettent ais\u00e9ment de camoufler des donn\u00e9es au travers d’un terminal, sans que celles-ci soient accessibles via l’explorateur Windows. Pris\u00e9s des utilisateurs malveillants, de tels dossiers servent souvent \u00e0 planquer des malwares et autres outils destin\u00e9s \u00e0 corrompre un syst\u00e8me.<\/p>\n

<\/p>","protected":false},"excerpt":{"rendered":"

Dans tous\u00a0environnements\u00a0Windows il y a des dossiers que l’on peut qualifier de “sp\u00e9ciaux”. Ces dossiers sont\u00a0r\u00e9guli\u00e8rement\u00a0repr\u00e9sent\u00e9s par une ic\u00f4ne sp\u00e9cifique, […]<\/p>\n","protected":false},"author":1337,"featured_media":1178,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[59,124,165,167],"tags":[135,160,136,152,161,162,118,117,35],"class_list":["post-377","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administration-reseaux-et-systemes","category-invisibilite-et-camouflage","category-os","category-windows","tag-camouflage","tag-dossiers-speciaux","tag-invisibilite","tag-regedit","tag-registre","tag-ressources","tag-windows-7","tag-windows-8","tag-windows-xp"],"_links":{"self":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/posts\/377","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/users\/1337"}],"replies":[{"embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/comments?post=377"}],"version-history":[{"count":8,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/posts\/377\/revisions"}],"predecessor-version":[{"id":1640,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/posts\/377\/revisions\/1640"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/media\/1178"}],"wp:attachment":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/media?parent=377"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/categories?post=377"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/tags?post=377"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}