General discussion

Locked

Ftp server hacked can't del directories

By bwilson ·
Someone hacked my ftp server on win2000 iis 5.0 and I can not delete the directories they made. Here is what the directory structure they made looks like.

Volume in drive C has no label.
Volume Serial Number is B446-6773

Directory of C:\Inetpub\ftproot

02/05/2002 01:16p <DIR> .
02/05/2002 01:16p <DIR> ..
02/04/2002 09:29a <DIR> TaGGeD
0 File(s) 0 bytes

Directory of C:\Inetpub\ftproot\TaGGeD

02/04/2002 09:29a <DIR> .
02/04/2002 09:29a <DIR> ..
02/04/2002 09:31a <DIR> =by.th?.Bl?ck$l?t?-›r?w=
0 File(s) 0 bytes

Directory of C:\Inetpub\ftproot\TaGGeD\=by.th?.Bl?ck$l?t?-›r?w=

02/04/2002 09:31a <DIR> .
02/04/2002 09:31a <DIR> ..
02/04/2002 09:29a <DIR>
02/04/2002 09:36a <DIR>
02/04/2002 09:30a <DIR>
02/04/2002 09:30a <DIR>
02/04/2002 09:30a <DIR>
02/04/2002 09:30a <DIR>
02/04/2002 09:30a <DIR>
02/04/2002 09:33a <DIR> prn.STAY.OUT.aux
02/04/2002 09:32a <DIR> prn.STAY.OUT.con
02/04/2002 09:31a <DIR> prn.STAY.OUT.lpt1
02/04/2002 09:33a <DIR> prn.STAY.OUT.nul
02/04/2002 09:30a <DIR> prn.STAY.OUT.prn
0 File(s) 0 bytes

Directory of C:\Inetpub\ftproot\TaGGeD\=by.th?.Bl?ck$l?t?-›r?w=\

02/04/2002 09:29a <DIR> .
02/04/2002 09:29a <DIR> ..
0 File(s) 0 bytes

This conversation is currently closed to new comments.

3 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by mrafrohead In reply to Ftp server hacked can't d ...

I would try to reboot the machine. You should then be able to delete the directories. If that doesn't work, go into recovery console and manually do it there.

Hope this helps

mrafrohead

Collapse -

you have a simple hack happen

by fx_68 In reply to Ftp server hacked can't d ...

the hacker used a simple added string to the creation of the folder names. you can use in DOS a ALT 255 or any combo around a few hundred with the alt key pressed and a number added you create a hidden character where the folder was created. you have to find out what character they used to make the folder. then you can delete the folders.


Read the following below it should anwser a little more about the ALT- Characters

In Microsoft Windows, you access special characters by holding down the ALT key and typing 0 (zero) followed by the character's number on the
NUMERIC KEYPAD (the regular keyboard numbers do not work for this operation). When you release the ALT key the character appears at the
cursor location in your document. The CHARACTER MAP accessory that comes with Windows is a utility which displays the available characters in a font, and specifies the Alt + XXX
codes for each one. It also lets you copy characters to the Clipboard so you can paste them into your document without having to type the ALT key combinations.
To find the Alt + 0XXX code in the CHARACTER MAP, locate the character you want and click on it. The key combination used to create the character is displayed in the lower right corner of the dialog box. To copy a character to the Clipboard, simply click on SELECT and then COPY (or just
double-click on it). When you do so, the character is added to the CHARACTERS TO COPY box. Return to your destination document, and choose
PASTE. The character will be pasted at the cursor location. You may choose as many characters as you need with this method. If the character does not appear to be in the font you selected (since after pasting, it may have reverted to your document's default font),simply highlight the character or characters and reselect the font from the application's font menu.
Hope this helps ya a little

Collapse -

Take Ownership

by rob In reply to you have a simple hack ha ...

You could also try... (although I think fx_68@routergod.com has the answer.) In Explorer right click select properties select security, select take ownership of the folder. If you can you should be able to delete it.

Back to IT Employment Forum
3 total posts (Page 1 of 1)  

Related Discussions

Related Forums