50 Covering Tracks – Hiding Programs and Files
Dante Rocca
Part of maintaining access is covering your tracks. One easy way to cover your tracks is through hiding files and programs. Additionally, the use of steganography can be used both to cover tracks and to send infected files.
Learning Objectives
- Create and view hidden files on Windows and Linux
- Utilize steganography to hide a file
Prerequisites
Deliverables
- Screenshot of ls -a command showing a hidden file
- Screenshot of file properties window in Windows showing a hidden file
- Screenshot of hide programs and features enabled in Windows
- Screenshot of OpenStego extraction success window
Resources
- Ojash Yadav – “How to Hide Apps on Windows” – https://www.maketecheasier.com/hide-apps-windows/
- “How to Show Hidden Files in Linux” – https://phoenixnap.com/kb/show-hidden-files-linux
Contributors and Testers
- Justin La Zare, Cybersecurity Student, ERAU-Prescott
Phase I – Hidden Files in Linux
In Linux, creation of hidden files is important to hide files from users. Luckily, creation of hidden files is easy in Linux. Unfortunately for our purposes, viewing hidden files in Linux is quite easy.
- Start the Kali VM. Open the terminal in any directory and create a text file with a message in it. For our example, the file will be called hiddenMessage.txt
- Use ls to show the file you created in the directory
- Hidden files in Linux are created by adding a period to the front of the file name. To do this in the terminal, type the following command
> mv hiddenMessage.txt .hiddenMessage.txt
- Now use ls again to make sure the file is hidden
- To view the hidden file, use the following command
> ls -a
Phase II – Hidden Files in Windows
Similar to hiding files on Linux, hiding files and viewing hidden files is easy on Windows.
- Launch the Windows VM and create a new text file on the desktop. Name it whatever you would like
- Right-click the newly made file and select Properties
- In the attributes section under the general tab, check Hidden
- Click Apply and then OK. You should see the file disappear from the Desktop
- To view the hidden file, open File Explorer. Go to Desktop in File Explorer
- Click the view bar at the top. Check the box that says Hidden items
- The hidden file should reappear on the desktop and in the File Explorer window
Phase III – Hiding Programs in Windows
- Right-click the Windows start icon and then click run. In the textbox that pops up, type the following
> gpedit.msc
- Hit enter, and in the left pane of the Local Group Policy Editor window that opens, click the Administrative Templates tab under the User Configuration tab
- In the right pane, double-click Control Panel
- In the right pane, double-click Programs
- Right-click the Hide “Programs and Features” page. Select edit
- Click the Enabled radio button and then click Apply and OK. This will prevent users from accessing the programs and features page. This will prevent users from accessing the programs and featu