50 Covering Tracks – Hiding Programs and Files

Part of maintaining access is covering your tracks. One easy way to cover your tracks is through hiding files and programs. Additionally, the use of steganography can be used both to cover tracks and to send infected files.

Learning Objectives

• Create and view hidden files on Windows and Linux
• Utilize steganography to hide a file

Prerequisites

• Create a Windows Server
• Build the Baseline Environment

Deliverables

• Screenshot of ls -a command showing a hidden file
• Screenshot of file properties window in Windows showing a hidden file
• Screenshot of hide programs and features enabled in Windows
• Screenshot of OpenStego extraction success window

Resources

• Ojash Yadav – “How to Hide Apps on Windows” – https://www.maketecheasier.com/hide-apps-windows/
• “How to Show Hidden Files in Linux” – https://phoenixnap.com/kb/show-hidden-files-linux

Contributors and Testers

• Justin La Zare, Cybersecurity Student, ERAU-Prescott

1. Start the Kali VM. Open the terminal in any directory and create a text file with a message in it. For our example, the file will be called hiddenMessage.txt
2. Use ls to show the file you created in the directory
3. Hidden files in Linux are created by adding a period to the front of the file name. To do this in the terminal, type the following command

   > mv hiddenMessage.txt .hiddenMessage.txt

4. Now use ls again to make sure the file is hidden
5. To view the hidden file, use the following command

   > ls -a

1. Launch the Windows VM and create a new text file on the desktop. Name it whatever you would like
2. Right-click the newly made file and select Properties
3. In the attributes section under the general tab, check Hidden
   

   

4. Click Apply and then OK. You should see the file disappear from the Desktop
5. To view the hidden file, open File Explorer. Go to Desktop in File Explorer
6. Click the view bar at the top. Check the box that says Hidden items
   

   

7. The hidden file should reappear on the desktop and in the File Explorer window

1. Right-click the Windows start icon and then click run. In the textbox that pops up, type the following

   > gpedit.msc

2. Hit enter, and in the left pane of the Local Group Policy Editor window that opens, click the Administrative Templates tab under the User Configuration tab
3. In the right pane, double-click Control Panel
4. In the right pane, double-click Programs
5. Right-click the Hide “Programs and Features” page. Select edit
   

   

6. Click the Enabled radio button and then click Apply and OK. This will prevent users from accessing the programs and features page. This will prevent users from accessing the programs and features page to view and uninstall programs
   

   

1. Switch to the Kali VM. Start by creating one text file you want to hide. Then, download any image file to hide the message in
2. Click the Kali logo at the top left and search for OpenStego. Open the program

   NOTE: If you do not see OpenStego, follow the steps to install the program.

   1. Navigate to https://www.openstego.com in the Kali VM
   2. Click “Download” at the top of the page
   3. Download the latest release; the file should end with the .deb extension
   4. Run the following command on the downloaded file to install OpenStego.

      > sudo dpkg -i <filename>.deb

3. Click the three dots next to the Message file input. Locate the text file you made and select it
4. Click the three dots next to the Cover file input. Locate the image you downloaded and select it
5. Click the three dots next to the Output file input to select where to save the stego file. If you don’t specify a path and type a name, it will be sent to the current user’s home directory
   

   

6. Click Hide data
7. Now that we’ve hidden the message, we can try to extract it. First, delete your message file
8. Now go back to OpenStego and then click the Extract data tab
9. Click the three dots near the Input stego file input and select your stego file
10. Click the three dots near the Output folder for message file input and select where you want the message to be sent
    

    

11. Click the Extract data button
12. Go to where you saved the message and check to make sure your message is still the same

End of Lab

No Figures in this Chapter