The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

How to move into a directory that begins with a \ and ends in a \

Discussion in 'General Discussion' started by nat, Jun 19, 2008.

  1. nat

    nat Well-Known Member

    Joined:
    Jan 16, 2003
    Messages:
    204
    Likes Received:
    0
    Trophy Points:
    16
    This is for RedHat Enterprise 5.

    How do you cd to a directory that begins with a \ and ends in a \

    Example:

    Directory: \test\

    I tried:

    cd \test\
    cd \\test\\
    cd "\test\"
    cd *test*

    None worked.

    Wasn't able to find out how to delete it either using rm -rf

    I was able to delete it using a perl script.

    #!/usr/bin/perl

    cleanup("/home/user/public_html/\test\");

    sub cleanup {
    my $dir = shift;
    local *DIR;

    opendir DIR, $dir or die "opendir $dir: $!";
    for (readdir DIR) {
    next if /^\.{1,2}$/;
    my $path = "$dir/$_";
    unlink $path if -f $path;
    cleanup($path) if -d $path;
    }
    closedir DIR;
    rmdir $dir or print "error - $!";
    }


    -----------------

    PS: Yeah, i know. The web hosting account was hacked due to old vulnerable script within web space. The entire account has been deleted, a new hosting account setup, and will now start completely over. I just wanted to know what was in the directory and how to remove it using unix commands.
     
  2. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,279
    Likes Received:
    36
    Trophy Points:
    48
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    Assume you are logged in via SSH as the user, you are probably in the user' ry home directory ( /home/user ). If the test folder is in the public_html directory then you'd need to do something like:

    cd /home/user/public_html/test

    If you wanted to delete it you'd do:

    rm -rf /home/user/public_html/test

    Depending on where you are at present ( type pwd to get the present working directory). From there you'll know how to get to test. If you type 'pwd' and it says you are in /home/user, then you'd cd public_html/test or rm -rf public_html/test . If pwd indicates you are in /home/user/public_html then you'd simpy cd test or rm -rf test.

    Mike



     
  3. nat

    nat Well-Known Member

    Joined:
    Jan 16, 2003
    Messages:
    204
    Likes Received:
    0
    Trophy Points:
    16
    Thanks but you missed the part about the directory containing backslash characters.

    The problem is the directory name contains "\"

    The directory actuall is named "\test\"

    The directory name begins with a backslash and ends in a backslash.

    rm -rf /home/user/public_html/test does not work

    rm -rf /home/user/public_html/\test\ does not work

    rm -rf /home/user/public_html/\\test\\ does not work

    rm -rf /home/user/public_html/*test* does not work
     
  4. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,279
    Likes Received:
    36
    Trophy Points:
    48
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    root@cp [/home/ovs]# mkdir "\\test\\"

    root@cp [/home/ovs]# ls|grep test
    \\test\\/

    root@cp [/home/ovs]# rm -rf "\\test\\"/

    root@cp [/home/ovs]# ls|grep test

    root@cp [/home/ovs]#

    Mike
     
  5. nat

    nat Well-Known Member

    Joined:
    Jan 16, 2003
    Messages:
    204
    Likes Received:
    0
    Trophy Points:
    16
    Not quit the same.

    Your directory name contains double backslashes: \\

    I apologize for not making the question clear and providing step-by-step instructions on how to reproduce.

    1. Login via ssh

    2. Move to a test directory

    3. nano mkdir.pl

    4. Add the following text

    #!/usr/bin/perl
    mkdir "\test\test" ;

    5. Save and exit nano

    6. chmod 755 mkdir.pl

    7. perl mkdir.pl

    8. dir -al

    drwxr-xr-x 2 root root 4096 Jun 19 11:33 \test\test/

    9. rmdir "\test\test"
    rmdir: `\\test\\test': No such file or directory

    10. rmdir \test\test
    rmdir: `testtest': No such file or directory

    11. rmdir \\test\\test
    rmdir: `\\test\\test': No such file or directory

    See how in step 9 the quotes turns a single backslash into a double and it won't rmeove?

    See how in step 10 the single backslashes are just ignored?

    See how in step 11 if you try to escape the second backslash with a backslash it will add two backslashes when deleting.

    I can find no way to delete a directory that contains a single backslash using shell. If the os doesn't have anything to delete a directory or file name that contains a single backslash, then it should not allow a directory or file to be created that contains a single backslash.
     
    #5 nat, Jun 19, 2008
    Last edited: Jun 19, 2008
  6. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,279
    Likes Received:
    36
    Trophy Points:
    48
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    You probably just need to remove it with whatever you created it with. Using rmdir in PERL will remove it, since mkdir in PERL made it. You can't make it using the util mkdir and you can't delete it using the util rmdir, I understand that.

    Obviously the PERL mkdir function and rmdir function behave differently than the mkdir/rmdir utils. And technically, since PERL would/should be installed on any unix system, the "OS" technically has what it needs to remove the file. No?

    Mike
     
  7. nat

    nat Well-Known Member

    Joined:
    Jan 16, 2003
    Messages:
    204
    Likes Received:
    0
    Trophy Points:
    16
    Someones site was hacked. The hackers used this single backslash thing for a reason and that is to prevent people from looking in the directory. I was wanting to move into the directory to see what was in it but could not because cd doesn't work on directoires that contain a single backslash. I was able to delete the directory using perl but it would have been nice if i could have looked at the files inside that directory. To me, it seems pretty stupid that directoires cannot be cd, mv, rm via shell as root and I thought there might be a way using some switch or something.
     
    #7 nat, Jun 19, 2008
    Last edited: Jun 19, 2008
  8. hydra

    hydra Well-Known Member

    Joined:
    Mar 26, 2008
    Messages:
    102
    Likes Received:
    1
    Trophy Points:
    18
    Location:
    Amsterdam, Netherlands
    Hi,

    Maybe you can use winSCP or something like it to examine or delete the dir?

    Ronald.
     
  9. cPanelKenneth

    cPanelKenneth cPanel Development
    Staff Member

    Joined:
    Apr 7, 2006
    Messages:
    4,458
    Likes Received:
    22
    Trophy Points:
    38
    cPanel Access Level:
    Root Administrator
    It sounds like more than simple site defacing/hacking:

    Code:
    dtest ~ # mkdir temp
    dtest ~ # cd temp
    dtest temp # mkdir \\test\\
    dtest temp # ls -C1
    \test\
    dtest temp # rmdir \\test\\
    dtest temp # ls -C1
    dtest temp # mkdir \\test\\test
    dtest temp # ls -l
    total 4
    drwxr-xr-x 2 root root 4096 Jun 24 04:56 \test\test
    dtest temp # rmdir \\test\\test 
    dtest temp # ls -l
    total 0
    
    
    You should perform a full system analysis as some of your binaries are likely compromised.
     
  10. nat

    nat Well-Known Member

    Joined:
    Jan 16, 2003
    Messages:
    204
    Likes Received:
    0
    Trophy Points:
    16
    It acts exactly the same on a brand new system. You cannot remove directories that contain a single backslash using "rmdir" where the directory was created by a perl script.
     
  11. cPanelKenneth

    cPanelKenneth cPanel Development
    Staff Member

    Joined:
    Apr 7, 2006
    Messages:
    4,458
    Likes Received:
    22
    Trophy Points:
    38
    cPanel Access Level:
    Root Administrator
    Code:
    dtest temp # cat t.pl 
    #!/usr/bin/perl
    
    mkdir "\test\test";
    dtest temp # perl t.pl 
    dtest temp # rmdir 
    ^Iest^Iest/       t.pl              
    dtest temp # rmdir "    est     est"
    dtest temp # ls -l
    total 4
    -rw-r--r-- 1 root root 37 Jun 24 05:08 t.pl
    dtest temp # 
    
    The apparent spaces in the rmdir command are obtained in bash by typing ctrl+v, ctrl+i If you are using a different shell then you need to read the documentation on typing meta characters.
     
Loading...

Share This Page