Firstly apologies, I asked this question a few days ago but had to delete it because I left in some sensitive information. I would have edited but it got a reply which echoed the same information (sorry harrymc!)
We have a bunch of assets that have been compromised and injected with files on a web server running Win Server 2012 R2 for example:
- LPT3.H3EgW.asp
- LPT7.PVYMnLcu2.asp
- AUX.Ayqgg1e.asp
- CON.9w84pu.cer
It's not possible to remove these via explorer as it'll return Invalid File Handle because the filenames have reserved words in them.
I can remove them with:
del \\.\D:\path_to_file\CON.9w84pu.cer
I'd like to be able to search all sub directories for a pattern like LPT3.*.asp
(and/or LPT*.*.asp
) within a main parent directory and delete any it finds.
D:\inetpub\
contains a many vhost directories so I want to be able to hit them all in one go.
I've tried the following within PowerShell:
Get-Childitem -path D:\inetpub\ -Filter *.asp -Recurse | where-object {$_.Name -ilike "LPT3.*.asp"} | Remove-Item -Force
But that returns: "Remove-Item : Cannot remove item .\LPT3: Could not find file".
Also tried the following in command line from a parent directory
del /Q /F /S "LPT3.*.asp"
But that returns: "The filename, directory name, or volume label syntax is incorrect."
User harrymc suggested:
cd /mnt/d/inetpub
rm `find . -name 'LPT3.*.asp' -print`
But that involves installing WSL and I'd like to avoid installing additional stuff for now and see if it's possible as is.
Update 20/08/2021:
Tried the following as per User harrymc comment:
Get-Childitem -path \\?\d:\inetpub\ -Filter *.asp -Recurse | where-object {$_.Name -ilike "LPT7.*.asp"} | Remove-Item -Force
Didn't receive an error and PowerShell (running as Admin) returned a new line ready for the next command so it looked like it might have worked but when I checked the directory the file was still there.
Interestingly, I changed the above line to a more aggressive one (it was in a vhosts dir where there shouldn't legitimately be any .asp files)
Get-Childitem -path d:\inetpub\domainname.co.uk\httpdocs\ -Filter *.asp -Recurse | Remove-Item -Force
And got the following:
Remove-Item : Cannot remove item \\.\LPT7: Could not find file
'D:\inetpub\domainname.co.uk\httpdocs\images\LPT7.PVYMnLcu2.asp'.
At line:1 char:85
+ ... asp -Recurse | Remove-Item -Force
+ ~~~~~~~~~~~~~~~~~~
+ CategoryInfo : WriteError: (D:\inetpub\doma...7.PVYMnLcu2.asp:FileInfo) [Remove-Item], FileNotFoundExce
ption
+ FullyQualifiedErrorId : RemoveFileSystemItemIOError,Microsoft.PowerShell.Commands.RemoveItemCommand
In the first line, PowerShell knows it needs \\.\
(like in the CMD del command that works) but if I try using that at the beginning of the path I get "Get-Childitem : The given path's format is not supported."
Is there a way I could use a batch file to find and loop through the items that match which then uses the command del \\.\D:\path_to_found_file\LTP3.foundfilename.asp
and inserts the filename to delete?
Get-Childitem
command to specify the path as\\?\d:\inetpub
.