files with backslashes in their names

There were two folders on the server I’d forgotten about, both left over from an upload that failed in September. One was a half-finished copy of the theme. The other was stranger.

Inside it were two files named assets\css\main.css and assets\js\site.js. No subdirectories, no folders — flat files whose names contain a backslash, which is the character Windows puts between one folder and the next, and which on the server is just a letter. So each file is named like a path and can’t be reached by one. A transfer tool, at some point, took a Windows path and used the whole string as a filename.

Nothing errored. That’s the part I keep coming back to. A tool that would rather write a strange name than tell me it couldn’t tell a path from a name.

Deleting them took most of an afternoon. The transfer client won’t list a filename containing a backslash. It skips the entry and reports that it’s ignoring a server-supplied filename it considers dangerous, which is my own upload, flagged as an attack, by my own tool. The same client has no recursive delete. The command for removing a directory refuses to remove one with anything in it. The account has no shell. Three dead ends on two files.

What worked was PHP. Walk the directory, delete from the deepest level up, then delete the script itself and stop. Put a random token in the query string so nobody else can run it. Hit it once, then hit it again to confirm it’s gone.

So I wrote a script that recursively deletes files and then removes itself, uploaded it to my own website, and executed it. Structurally that’s malware. The only differences are that I wrote it and that I meant it.

The folders are gone, and the request that ran the script now returns nothing. I read it before I ran it, which tells you what I thought of it.