HTB Academy - File System

Pros of FAT32:

• Device compatibility - it can be used on computers, digital cameras, gaming consoles, smartphones, tablets, and more.

 - Operating system cross-compatibility - It works on all Windows operating systems starting from Windows 95 and is also supported by MacOS and Linux.
 

Cons of FAT32:

• Can only be used with files that are less than 4GB.
• No built-in data protection or file compression features.
• Must use third-party tools for file encryption.

NTFS (New Technology File System) is the default Windows file system since Windows NT 3.1. In addition to making up for the shortcomings of FAT32, NTFS also has better support for metadata and better performance due to improved data structuring.

Pros of NTFS:

• NTFS is reliable and can restore the consistency of the file system in the event of a system failure or power loss.
• Provides security by allowing us to set granular permissions on both files and folders.
• Supports very large-sized partitions.
• Has journaling built-in, meaning that file modifications (addition, modification, deletion) are logged.

Cons of NTFS:

• Most mobile devices do not support NTFS natively.
• Older media devices such as TVs and digital cameras do not offer support for NTFS storage devices.

The resource access level is list after each user in the output. The possible inheritance settings are:

• (CI): container inherit
• (OI): object inherit
• (IO): inherit only
• (NP): do not propagate inherit

 - `(I)`: permission inherited from parent container
 

In the above example, the NT AUTHORITY\SYSTEM account has object inherit, container inherit, inherit only, and full access permissions. This means that this account has full control over all file system objects in this directory and subdirectories.

Basic access permissions are as follows:

• F : full access

 - `D` :  delete access

• N :  no access
• M :  modify access
• RX :  read and execute access
• R :  read-only access
• W :  write-only access

 We can add and remove permissions via the command line using `icacls`. Here we are executing `icacls` in the context of a local administrator account showing the `C:\users` directory where the `joe` user does not have any write permissions.

C:\htb> icacls c:\Users c:\Users NT AUTHORITY\SYSTEM:(OI)(CI)(F) BUILTIN\Administrators:(OI)(CI)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) Everyone:(RX) Everyone:(OI)(CI)(IO)(GR,GE) Successfully processed 1 files; Failed processing 0 files

Using the command icacls c:\users /grant joe:f we can grant the joe user full control over the directory, but given that (oi) and (ci) were not included in the command, the joe user will only have rights over the c:\users folder but not over the user subdirectories and files contained within them.

C:\htb> icacls c:\users /grant joe:f processed file: c:\users Successfully processed 1 files; Failed processing 0 files

C:\htb> >icacls c:\users c:\users WS01\joe:(F) NT AUTHORITY\SYSTEM:(OI)(CI)(F) BUILTIN\Administrators:(OI)(CI)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) Everyone:(RX) Everyone:(OI)(CI)(IO)(GR,GE) Successfully processed 1 files; Failed processing 0 files

These permissions can be revoked using the command icacls c:\users /remove joe.

icacls is very powerful and can be used in a domain setting to give certain users or groups specific permissions over a file or folder, explicitly deny access, enable or disable inheritance permissions, and change directory/file ownership.