1

Firstly apologies, I asked this question a few days ago but had to delete it because I left in some sensitive information. I would have edited but it got a reply which echoed the same information (sorry harrymc!)

We have a bunch of assets that have been compromised and injected with files on a web server running Win Server 2012 R2 for example:

  • LPT3.H3EgW.asp
  • LPT7.PVYMnLcu2.asp
  • AUX.Ayqgg1e.asp
  • CON.9w84pu.cer

It's not possible to remove these via explorer as it'll return Invalid File Handle because the filenames have reserved words in them.

I can remove them with:

del \\.\D:\path_to_file\CON.9w84pu.cer

I'd like to be able to search all sub directories for a pattern like LPT3.*.asp (and/or LPT*.*.asp) within a main parent directory and delete any it finds. D:\inetpub\ contains a many vhost directories so I want to be able to hit them all in one go.

I've tried the following within PowerShell:

Get-Childitem -path D:\inetpub\ -Filter *.asp -Recurse | where-object {$_.Name -ilike "LPT3.*.asp"} | Remove-Item -Force

But that returns: "Remove-Item : Cannot remove item .\LPT3: Could not find file".

Also tried the following in command line from a parent directory

del /Q /F /S "LPT3.*.asp"

But that returns: "The filename, directory name, or volume label syntax is incorrect."

User harrymc suggested:

cd /mnt/d/inetpub
rm `find . -name 'LPT3.*.asp' -print`

But that involves installing WSL and I'd like to avoid installing additional stuff for now and see if it's possible as is.

Update 20/08/2021:

Tried the following as per User harrymc comment:

Get-Childitem -path \\?\d:\inetpub\ -Filter *.asp -Recurse | where-object {$_.Name -ilike "LPT7.*.asp"} | Remove-Item -Force

Didn't receive an error and PowerShell (running as Admin) returned a new line ready for the next command so it looked like it might have worked but when I checked the directory the file was still there.

Interestingly, I changed the above line to a more aggressive one (it was in a vhosts dir where there shouldn't legitimately be any .asp files)

Get-Childitem -path d:\inetpub\domainname.co.uk\httpdocs\ -Filter *.asp -Recurse | Remove-Item -Force

And got the following:

Remove-Item : Cannot remove item \\.\LPT7: Could not find file
'D:\inetpub\domainname.co.uk\httpdocs\images\LPT7.PVYMnLcu2.asp'.
At line:1 char:85
+ ... asp -Recurse | Remove-Item -Force
+                    ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : WriteError: (D:\inetpub\doma...7.PVYMnLcu2.asp:FileInfo) [Remove-Item], FileNotFoundExce
   ption
    + FullyQualifiedErrorId : RemoveFileSystemItemIOError,Microsoft.PowerShell.Commands.RemoveItemCommand

In the first line, PowerShell knows it needs \\.\ (like in the CMD del command that works) but if I try using that at the beginning of the path I get "Get-Childitem : The given path's format is not supported."

Is there a way I could use a batch file to find and loop through the items that match which then uses the command del \\.\D:\path_to_found_file\LTP3.foundfilename.asp and inserts the filename to delete?

2
  • 1
    Try in the Get-Childitem command to specify the path as \\?\d:\inetpub.
    – harrymc
    Aug 19, 2021 at 10:38
  • @harrymc thought that might and did work, but it didn't, I've updated my question to reflect the attempt.
    – PeteB
    Aug 20, 2021 at 8:48

2 Answers 2

0

If Get-Childitem can list these files, I suggest writing the file-names to a text file named f.bat, use a text editor to convert the list to del \\?\d:\..., then execute the batch file.

This PowerShell command can get you the starting list:

Get-Childitem -path d:\inetpub\domainname.co.uk\httpdocs\ -Filter *.asp -Recurse | Select-Object -Property FullName | Out-File -FilePath .\f.bat
3
  • Loving this approach! And it works, I've adjusted it to Get-Childitem -path d:\inetpub\domainname.co.uk\httpdocs\ -Filter *.asp -Recurse | where-object {$_.Name -ilike "LPT*.*.asp"} | Select-Object -Property FullName | Out-File -FilePath d:\f.txt so it's not as aggressive (not all .asp files in other directories will be illegitimate). Any ideas on how I can expand the wildcard search to a list of possible matches, LPT*.*.asp OR CON.*.cer OR AUX.*.asp OR COM*.*.asp etc?
    – PeteB
    Aug 20, 2021 at 10:05
  • You may either use multiple Get-Childitem commands, using for the second and following Out-File -Append. Or use -Include instead of -Filter (see link).
    – harrymc
    Aug 20, 2021 at 10:10
  • it was helpful/food for thought, but wasn't an answer/solution, sorry!
    – PeteB
    Nov 12, 2021 at 12:45
0

So I eventually settled for this and abandoned the route of PowerShell.

It's not pretty or elegant, but it worked.

SET "patterncon=CON"
SET "pattern=LPT1"
SET "pattern2=LPT2"
SET "pattern3=LPT3"
SET "pattern4=LPT4"
SET "pattern5=LPT5"
SET "pattern6=LPT6"
SET "pattern7=LPT7"
SET "pattern8=LPT8"
SET "pattern9=LPT9"
SET "pattern10=AUX"
SET "pattern11=CON"
SET "pattern12=PRN"
SET "pattern13=COM1"
SET "pattern14=COM2"
SET "pattern15=COM3"
SET "pattern16=COM4"
SET "pattern17=COM5"
SET "pattern18=COM6"
SET "pattern19=COM7"
SET "pattern20=COM8"
SET "pattern21=COM9"

FOR /R "D:\inetpub" %%# in (*.cer) DO (
    ECHO %%~nx# | FIND "%patterncon%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%# 
    )
)

FOR /R "D:\inetpub" %%# in (*.asp) DO (
    ECHO %%~nx# | FIND "%pattern%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern2%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern3%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern4%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern5%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern6%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern7%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern8%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern9%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern10%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern11%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern12%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern13%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern14%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern15%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern16%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern17%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern18%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern19%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern20%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
    ECHO %%~nx# | FIND "%pattern21%" 1>NUL && (
        Echo \\.\%%#
        del \\.\%%#
    )
)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.