Skip to content
/ Zoner Public

A tool to get/set/delete the Zone.Identifier Alternate Data Stream in a NTFS based file

Notifications You must be signed in to change notification settings

twiz718/Zoner

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Usage:

$ ./Zoner.exe -f /c/Users/akhanin/Desktop/autoruns/autoruns.exe -g -h
   _____
  |___ / ___ _ __   ___ _ __
    / // _ \| '_ \ / _ \ '__|
   / /| (_) | | | | __ / |
  /____\___/|_| | |\___|_| by @twiz718

  Zoner will allow you to set the Zone.Identifier ADS (Alternate Data Stream) of a file.
  `-> The Zone.Identifier values are enumerated here: https://msdn.microsoft.com/en-us/library/ms537175.aspx

  -q                         quiet mode
  -f, --filename=FILENAME    the FILENAME to set the Zone.Identifier value in.
  -z, --zoneid=ZONE_ID       the ZONE_ID value (INTEGER ONLY)
  -u, --url=VALUE            the ReferrerUrl value to set (optional)
  -s, --set                  SET the value of ZONE_ID provided
  -g, --get                  GET the value of ZONE_ID from FILENAME
  -d, --delete               DELETE the Zone.Identifier ADS from FILENAME
  -l, --listzones            List the Zone.Identifier values
  -h, --help                 show usage and exit

Getting the Zone.Identifier from a file:

$ ./Zoner.exe -f /c/Users/akhanin/Desktop/autoruns/autoruns.exe -g -q
[ZoneTransfer]
ZoneId=0
ReferrerUrl=foo

Setting the Zone.Identifier in a file:

$ ./Zoner.exe -f /c/Users/akhanin/Desktop/autoruns/autoruns.exe -s -z 4
   _____
  |___ / ___ _ __   ___ _ __
    / // _ \| '_ \ / _ \ '__|
   / /| (_) | | | | __ / |
  /____\___/|_| | |\___|_| by @twiz718

Deleting Zone.Identifier ADS from C:/Users/akhanin/Desktop/autoruns/autoruns.exe
Writing Zone.Identifier value 4 to file C:/Users/akhanin/Desktop/autoruns/autoruns.exe.

Deleting the Zone.Identifier from a file:

$ ./Zoner.exe -f /c/Users/akhanin/Desktop/autoruns/autoruns.exe -d
   _____
  |___ / ___ _ __   ___ _ __
    / // _ \| '_ \ / _ \ '__|
   / /| (_) | | | | __ / |
  /____\___/|_| | |\___|_| by @twiz718

Deleting Zone.Identifier ADS from C:/Users/akhanin/Desktop/autoruns/autoruns.exe

Finding files with ADS:

dir /s /r | find ":$DATA"

About

A tool to get/set/delete the Zone.Identifier Alternate Data Stream in a NTFS based file

Resources

Stars

Watchers

Forks

Packages

No packages published

Languages