Welcome!

By registering with us, you'll be able to discuss, share and private message with other members of our community.

SignUp Now!

PSHELL and NTFS File Streams

Aug
1,917
68
Code:
     _x64: 1
   _admin: 1
_elevated: 1

TCC  26.01.40 x64   Windows 10 [Version 10.0.18363.900]

I have a .PS1 file as a stream name, however, PSHELL does not seem to recognize it;
Code:
e:\utils>type cmenu.btm:cmenu.ps1
$o = new-object -com "Shell.Application"
$folder = $o.NameSpace("C:\PROGRA~1\JPSoft\TCMD26\")
$file = $folder.ParseName("tcc.exe")
$file.InvokeVerb("Properties")

e:\utils>pshell cmenu.btm:cmenu.ps1

e:\utils>dir /: cmenu.btm

Volume in drive E is New Volume   Serial number is 2c1e:6e61
Directory of  E:\Utils\cmenu.btm

2020-07-22   9:04             296  cmenu.btm
                              166    cmenu.ps1:$DATA
                 462 bytes in 1 file and 0 dirs    8,192 bytes allocated
   1,458,335,899,648 bytes free

e:\utils>

If I use a non-stream file,
Code:
PSHELL cmenu.ps1
it works as it should.

Is this WAD, that is, PSHELL does not recognize stream files?

Joe
 
That's odd since you can execute the stream directly in Powershell. Below, this is Powershell and the second command works.

1595431826388.png
 

Similar threads

Back
Top