1

Firstly apologies, I asked this question a few days ago but had to delete it because I left in some sensitive information. I would have edited but it got a reply which echoed the same information (sorry harrymc!)

We have a bunch of assets that have been compromised and injected with files on a web server running Win Server 2012 R2 for example:

  • LPT3.H3EgW.asp
  • LPT7.PVYMnLcu2.asp
  • AUX.Ayqgg1e.asp
  • CON.9w84pu.cer

It's not possible to remove these via explorer as it'll return Invalid File Handle because the filenames have reserved words in them.

I can remove them with:

del \\.\D:\path_to_file\CON.9w84pu.cer

I'd like to be able to search all sub directories for a pattern like LPT3.*.asp (and/or LPT*.*.asp) within a main parent directory and delete any it finds. D:\inetpub\ contains a many vhost directories so I want to be able to hit them all in one go.

I've tried the following within PowerShell:

Get-Childitem -path D:\inetpub\ -Filter *.asp -Recurse | where-object {$_.Name -ilike "LPT3.*.asp"} | Remove-Item -Force

But that returns: "Remove-Item : Cannot remove item .\LPT3: Could not find file".

Also tried the following in command line from a parent directory

del /Q /F /S "LPT3.*.asp"

But that returns: "The filename, directory name, or volume label syntax is incorrect."

User harrymc suggested:

cd /mnt/d/inetpub
rm `find . -name 'LPT3.*.asp' -print`

But that involves installing WSL and I'd like to avoid installing additional stuff for now and see if it's possible as is.

Update 20/08/2021:

Tried the following as per User harrymc comment:

Get-Childitem -path \\?\d:\inetpub\ -Filter *.asp -Recurse | where-object {$_.Name -ilike "LPT7.*.asp"} | Remove-Item -Force

Didn't receive an error and PowerShell (running as Admin) returned a new line ready for the next command so it looked like it might have worked but when I checked the directory the file was still there.

Interestingly, I changed the above line to a more aggressive one (it was in a vhosts dir where there shouldn't legitimately be any .asp files)

Get-Childitem -path d:\inetpub\domainname.co.uk\httpdocs\ -Filter *.asp -Recurse | Remove-Item -Force

And got the following:

Remove-Item : Cannot remove item \\.\LPT7: Could not find file
'D:\inetpub\domainname.co.uk\httpdocs\images\LPT7.PVYMnLcu2.asp'.
At line:1 char:85
+ ... asp -Recurse | Remove-Item -Force
+                    ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : WriteError: (D:\inetpub\doma...7.PVYMnLcu2.asp:FileInfo) [Remove-Item], FileNotFoundExce
   ption
    + FullyQualifiedErrorId : RemoveFileSystemItemIOError,Microsoft.PowerShell.Commands.RemoveItemCommand

In the first line, PowerShell knows it needs \\.\ (like in the CMD del command that works) but if I try using that at the beginning of the path I get "Get-Childitem : The given path's format is not supported."

Is there a way I could use a batch file to find and loop through the items that match which then uses the command del \\.\D:\path_to_found_file\LTP3.foundfilename.asp and inserts the filename to delete?

2
  • 1
    Try in the Get-Childitem command to specify the path as \\?\d:\inetpub.
    – harrymc
    Aug 19, 2021 at 10:38
  • @harrymc thought that might and did work, but it didn't, I've updated my question to reflect the attempt.
    – PeteB
    Aug 20, 2021 at 8:48

2 Answers 2

0

If Get-Childitem can list these files, I suggest writing the file-names to a text file named f.bat, use a text editor to convert the list to del \\?\d:\..., then execute the batch file.

This PowerShell command can get you the starting list:

Get-Childitem -path d:\inetpub\domainname.co.uk\httpdocs\ -Filter *.asp -Recurse | Select-Object -Property FullName | Out-File -FilePath .\f.bat
3
  • Loving this approach! And it works, I've adjusted it to Get-Childitem -path d:\inetpub\domainname.co.uk\httpdocs\ -Filter *.asp -Recurse | where-object {$_.Name -ilike "LPT*.*.asp"} | Select-Object -Property FullName | Out-File -FilePath d:\f.txt so it's not as aggressive (not all .asp files in other directories will be illegitimate). Any ideas on how I can expand the wildcard search to a list of possible matches, LPT*.*.asp OR CON.*.cer OR AUX.*.asp OR COM*.*.asp etc?
    – PeteB
    Aug 20, 2021 at 10:05
  • You may either use multiple Get-Childitem commands, using for the second and following Out-File -Append. Or use -Include instead of -Filter (see link).
    – harrymc
    Aug 20, 2021 at 10:10
  • it was helpful/food for thought, but wasn't an answer/solution, sorry!
    – PeteB
    Nov 12, 2021 at 12:45
0

So I eventually settled for this and abandoned the route of PowerShell.

It's not pretty or elegant, but it worked.

SET "patterncon=CON"
SET "pattern=LPT1"
SET "pattern2=LPT2"
SET "pattern3=LPT3"
SET "pattern4=LPT4"
SET "pattern5=LPT5"
SET "pattern6=LPT6"
SET "pattern7=LPT7"
SET "pattern8=LPT8"
SET "pattern9=LPT9"
SET "pattern10=AUX"
SET "pattern11=CON"
SET "pattern12=PRN"
SET "pattern13=COM1"
SET "pattern14=COM2"
SET "pattern15=COM3"
SET "pattern16=COM4"
SET "pattern17=COM5"
SET "pattern18=COM6"
SET "pattern19=COM7"
SET "pattern20=COM8"
SET "pattern21=COM9"

FOR /R "D:\inetpub" %%# in (*.cer) DO (
    ECHO %%~nx# | FIND "%patterncon%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%# 
    )
)

FOR /R "D:\inetpub" %%# in (*.asp) DO (
    ECHO %%~nx# | FIND "%pattern%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern2%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern3%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern4%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern5%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern6%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern7%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern8%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern9%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern10%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern11%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern12%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern13%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern14%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern15%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern16%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern17%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern18%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern19%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern20%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern21%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .