windows 2000 and tagged dirs

ok, here's the deal. I have been working for this company for sometime, and have been telling them that they needed to get on the security bandwagon but they have been pretty much responded with indifference... until now.

Seems that their FTP site has been passed around by the "underground" like a $2 whore on shore leave. :eek:

We have several "tagged" directories with a lot of 0-day stuff in them. I have now been tasked with cleaning up this mess. I started with the basics. Installing every patch I could find, running IIS lockdown, and even disabling FTP access to our site. NOW here comes the difficult part, at least for me.

I can't seem to remove these tagged directories. They look something like this:

website root <dir>
tagged <dir>
by <dir>
a persons name <dir>
4 group name <dir>
com <dir> sometimes aux <dir>

Now I can't remove these directories, nor can I actually traverse them in explorer or from the command prompt. I also noticed in a couple of the directories that the "." and sometimes the ".." directories are missing or not listed.

Any help would be greatly appreciated. I can't boot from DOS as this machine is all NTFS and I don't have the NTFS boot software that's floating around out there.

This is also really causing a problem because their email server is running on this machine and there is no hard drive space left to create the virutal dirs needed to run email. There are approximately 5-6 GB of stuff on here that I need to get rid of yesterday :D

I can be reached at [email protected] if you wish to use email, or just post your ideas in here... I really need help here folks.


TIA,

El Diablo

Did you try to remove the files with local admin access?

yes I was logged on today as local admin, I have also tried as the Enterprise admin.

I'm at a loss :(


El Diablo

Try:
http://isp-lists.isp-planet.com/isp-.../msg00112.html

Dunno if that will help. I don't do NT.

The NTFS driver for DOS can be found here:
http://www.sysinternals.com/ntw2k/fr.../NTFSDOS.shtml
Never used it myself though, and it seems you have to by the pro version for read/write access... Anyways, check it out...

Ammo

hello

try to logg in locally like administrator and then
take the ownership of these folders and then delete this folders
(right click in the folder and then click TAKE OWNERSHIP).


I hope this helps you
bye

ok, tried the rm and rmdir that come with POSIX, but they didn't work :mad:

Now I am going to attempt to telnet to that server and see if I can do it from there.


I have tried as local admin, I have tried from the command prompt, I have tried from a DOS box connecting to the server and none of them work. Still at a loss here folks.

Thanks for the suggestions, keep 'em coming.



El Diablo

A Suggestion:

Turn off IIS. backup hard drive. format. install freebsd. run.
restore all website files. turn on webserver, if not, install apache (?).

OR

tell your company MD he should give you a pay you more to do security on the server :D

Same as BPX but instead of bsd just reinstall the webserver.
And make sure that you have all the patches on before you reconnect it to the web.

http://www1.dshield.org/pipermail/ds...er/001465.html

If *I* were you....I would format and reload the server....then install Apache for NT if your company insists on NT. NT/IIS combos are trivial at best in regards to security. NT/Apache is a step forward but still lacking.

Also just check the attribs. on the directories that you cannot delete. They prob. just attrib +r each one so you cannot delete it.

-Q

Diablo, if that was it (attrib -r, or checking the read-only box off), please tell us, so I can give NoNeckJoe some +antipoints :)

That would've been the last thing I'd think of...

Its more than attributes, why not give him the points anyway:-)

Out of curiosity, (in the same way of what magic1 said) what account owns these folders and what rights/permissions are set?

Ammo

alright I will give you guys some more info.

I have ownership of these files now, I claimed it as Admin. I removed the everyone group from having access, and of course granted myself full control over it and forced inheritence on all child objects. Also, the first thing I checked was the attrib on those files/dirs and removed the +a +s that was put there... but that still didn't help.

One thing that HAS helped was simply connecting through FTP and deleting them that way... but there are still some dirs that I can't get rid of, like the Com1, AUX directories.

petemcevoy has given the best link so far, as that is EXACTLY what my problem is. I am rooting around for a copy of the NT resource kit, but I seem to have misplaced my CD... personally I think someone at my last job "borrowed" it without telling me. I need to get the POSIX subsystem from it so I can start using some real commands to get rid of these dirs. I HAVE removed all of the files from the dirs though, and have reclaimed all of the space they were taking up... 6.2GB...

I had found the rm.exe and rmdir.exe on another website, but didn't install the POSIX subsystem, so that may be why they didn't work for me. I'm going to do just like the guy in the link from petemcevoy did.


Of course now my email server still isn't working because a dll is corrupted. If anyone has a copy of it let me know, it's abv_dg.dll it's used by Exchange 2000. It's located on the Exchange install disks, but wouldn't you know that disk is missing from work too and they haven't seen it in quite some time.


El Diablo
kicks some hackers, and upper management in the ass over this

Borrowed from the info Pete gave.

I was able to recreate this on a windows2000 server using com1 as the directory name com1. It was located at C:\temp\com1

Well after that, I couldn't delete it from windows or the command prompt normally (with the remove directory command).

So I tried the extented commands, didn't need any resource kit for this one:

RD \\?\c:\temp\com1

That nuked the directory no problem, but that was the easy part. I tried making the same one with some high bit characters like the asci 255 and others so it had to changed as well to:

RD \\?\c:\temp\ com1©÷¡î¡¤

You will have to find out what high bit characters are embedded in the name for this to work properly. Didn't need the resource kit to remove the reserved word directory, so you might be able to fix it without the cd :D

ok, im having some problems understanding this...i have tried every method i know to create a directory named "com1" or "com1 " or anything starting or ending with com1 on my win2k box...am i missing something? i tried the right click->new->directory and naming it "com1"...ive tried using the faux dos, no luck. i've also tried this on my girlfriends winME box...no go. what gives here? i was able to create [ALT]+255 + "com1", but that deleted just fine...
/me is confuzzled.

Quote:

---

Originally posted by 8*B@LL
ok, im having some problems understanding this...i have tried every method i know to create a directory named "com1" or "com1 " or anything starting or ending with com1 on my win2k box...am i missing something? i tried the right click->new->directory and naming it "com1"...ive tried using the faux dos, no luck. i've also tried this on my girlfriends winME box...no go. what gives here? i was able to create [ALT]+255 + "com1", but that deleted just fine...
/me is confuzzled.

---

same here. I've tried to create these dirs, but the error I get is that the file already exists. I wanted to test some stuff.

The RD \\?\*... worked on SOME of the tagged dirs, but not all of them.

There are still some of the original COM, AUX dirs that are on there that I can't remove. Also, I was able to remove a lot of them through FTP, but telnet didn't do a thing. Some of those that I couldn't remove via FTP I could remove using the RD command.

Still confused over this one.

FWIW, I now have a copy of the POSIX commands and subsystem from the NT 4 resource kit. I'll try those out today and see what happens.


El Diablo

if the severs security has been breached that badly you have no choice but to take it down and do it over. Make sure every patch is installed before you reconnnect and watch it close, Theres gonna be some people mad at loosing their playground.

Sounds like you have a big problem with security at work in and out of the computer world. I think I have that dll if I find it ill post a site up at geocites so you can dl it. But I do remember a site that had about every dll file known to man there, I found it while rooting around google.com something like, cracks or patches got me the right site. But I have a question for you where did you get the lock for the IIS? Im wanting to lock mine out but there is a message that pops up saying that some file was missing? who knows it was a burnt copy of 2000 anyways.

Quote:

---

Originally posted by El Diablo
alright I will give you guys some more info.

I have ownership of these files now, I claimed it as Admin. I removed the everyone group from having access, and of course granted myself full control over it and forced inheritence on all child objects. Also, the first thing I checked was the attrib on those files/dirs and removed the +a +s that was put there... but that still didn't help.

One thing that HAS helped was simply connecting through FTP and deleting them that way... but there are still some dirs that I can't get rid of, like the Com1, AUX directories.

petemcevoy has given the best link so far, as that is EXACTLY what my problem is. I am rooting around for a copy of the NT resource kit, but I seem to have misplaced my CD... personally I think someone at my last job "borrowed" it without telling me. I need to get the POSIX subsystem from it so I can start using some real commands to get rid of these dirs. I HAVE removed all of the files from the dirs though, and have reclaimed all of the space they were taking up... 6.2GB...

I had found the rm.exe and rmdir.exe on another website, but didn't install the POSIX subsystem, so that may be why they didn't work for me. I'm going to do just like the guy in the link from petemcevoy did.


Of course now my email server still isn't working because a dll is corrupted. If anyone has a copy of it let me know, it's abv_dg.dll it's used by Exchange 2000. It's located on the Exchange install disks, but wouldn't you know that disk is missing from work too and they haven't seen it in quite some time.


El Diablo
kicks some hackers, and upper management in the ass over this

---

Ok as far as your missing Exchange 2000 file, I know there used to be a site on the web http://ftpsearch.ntnu.no/ftpsearch that had the ability to find ANY dll file you were missing as long as it was on the internet somewhere. I don't know what they did with the server, but if you can find it, that might help with your missing file problems, as long as you have the filename.

El Diablo

Removing COM1 dirs etc. is actually quite easy.
I do it all the time for people ........

Set me up with ftp access to the server with those dirs
and i'll have them cleaned off in a matter of seconds.

Best way to contact me is via ICQ #2595277

How about posting some details on how to do it.

Posting details on how to get rid of those dirs. would be a redundancy .... it's been done ... which is why there are so many servers with those dirs. on them. The info has gotten into the hands of people that don't really know what to do with it and generally make a mess of things and don't know how to clean things up when they are done ... kinda like nuclear energy ...

The knowledge should be kept to those that are trusted, are willing to follow certain rules, and have the maturity to do "the right thing" with said knowledge. If I were to just barf up the details here, on a non-password protected forum, then any tom, dick, or newbie could find it with a google search and my post would be doing more harm than good.

Someone needs a few com1 dirs cleaned off their NT box and I posess the knowledge to do such cleaning. No more really needs to be said. I don't want any of you to think I have a "holier than thou" attitude, I'm just trying to protect some valuable information. Keep it out of the heads of those that would abuse it as opposed to do good with it.

I have had the same problem with an NT 4 machine. I found that if I used a Hex editor like WinHex. I was able to view the folders that were created using the devices, e.g. nul or com1. This helped give me an idea of which folders I needed to rename. I also used it to delete all the apps off the machine.

This topic has been discussed many times on
netknowledgebase . com and this topic is covered on the Microsoft site as well.



[quote from ms]


SUMMARY
Because applications control the policy for creating files in Windows, files sometimes are created with illegal or reserved names, such as LPT1 or PRN. This article explains how to delete such files using the standard user interface.



MORE INFORMATION
NOTE: You must be logged on locally to the Windows computer to delete these files.

If the file was created on a file allocation table (FAT) partition, you may be able to delete it under MS-DOS using standard command line utilities (such as DEL) with wildcards. For example:

DEL PR?.*

-or-


DEL LPT?.*


These commands do not work on an NTFS partition as NTFS supports the POSIX subsystem and filenames such as PRN are legal under this subsystem. However, the operating system assumes the application that created them can also delete them; therefore, you can use commands native to the POSIX subsystem.

You can delete (unlink) these files using a simple, native POSIX application. For example, the Windows Resource Kit includes such a tool, Rm.exe.

NOTE: POSIX commands are case sensitive. Drives and folders are referenced differently than in MS-DOS. Windows 2000 and later POSIX commands must use the following usage syntax:
posix /c <path\command> [<args>] IE: posix /c c:\rm.exe -d AUX.

Usage assumes Rm.exe is either in the path, or the current folder:
rm -d //driveletter/path using forward slashes/filename
For example, to remove a file or folder named COM1 (located at C:\Program Files\Subdir in this example), type the following command:
rm -d "//C/Program Files/Subdir/COM1"
To remove a folder and its entire contents (C:\Program Files\BadFolder in this example), type the following command:
rm -r "//C/Program Files/BadFolder"
Another option is to use a syntax that bypasses the normal reserve-word checks altogether. For example, you can possibly delete any file with a command such as:
DEL \\.\driveletter:\path\filename
For example:

DEL \\.\c:\somedir\aux



[/quote]


To test the effect of such names, in NT/Win2000, right-click your desktop and make a 'New Text Document', and name it CON. You should get an error message telling you that the name you chose is 'invalid' and for you to choose another name for that text file.


--- --- ---


hawk