Prohibited Files

The README usually forbids certain files on the machine: media the organization doesn't allow, and plain-text files holding passwords, card numbers, or personal information. Finding them is a find exercise; knowing where to look is the skill.

Media by extension

sudo find / -type f \( -iname '*.mp3' -o -iname '*.mp4' -o -iname '*.mkv' -o -iname '*.avi' -o -iname '*.mov' -o -iname '*.wav' -o -iname '*.flac' -o -iname '*.ogg' -o -iname '*.jpg' -o -iname '*.jpeg' -o -iname '*.png' -o -iname '*.gif' \) -not -path '/usr/*' -not -path '/snap/*' -not -path '/var/lib/*' -not -path '/proc/*' 2>/dev/null

The -not -path parts skip system files (icons, sounds that ship with the desktop). What's left is in home directories, /tmp, /var, /opt, /srv, or odd places. Read the README for which types it forbids; images often hide a music collection under /home/user/.local or /var/www.

find /home -type f -iname '*.mp3' -delete

Look at the list before you delete. A .png in a web server's /var/www/html/images may be the site's logo.

Files that hold secrets

sudo grep -rIlE -i 'password|passwd|credit ?card|ssn|social security' /home /root /var/www /opt /srv /tmp 2>/dev/null
sudo find / -type f \( -iname '*password*' -o -iname '*passwd*' -o -iname '*creds*' -o -iname '*secret*' -o -iname '*.bak' -o -iname '*backup*' \) -not -path '/usr/*' -not -path '/proc/*' -not -path '/snap/*' 2>/dev/null

Open each hit. A text file with a list of usernames and passwords, a spreadsheet of card numbers, a customers.csv with addresses and dates of birth: delete them (shred -u if you want the contents gone rather than just the name). A backup of /etc/shadow or of a database sitting in a world-readable directory is the same problem in a different shape; it comes off the machine or into a root-only directory, whichever the README supports.

Names that hide

Attackers use filenames that look normal or invisible in a listing:

ls -la ~ | cat -A
find /home /tmp /var -name '.*' -type f 2>/dev/null
find / -name '* *' -o -name $'*\u200b*' 2>/dev/null

cat -A shows non-printing characters. A name that ends in a zero-width space, or contains a space, still matches by extension in the find above but is easy to miss by eye; rm it with tab completion so the shell types the odd characters for you.

Files the README asks you to create

Sometimes the answer is the opposite: a README asks for a file or folder to exist, a script to be placed, a note to be written. Do exactly what it says, at exactly the path it names, with touch, mkdir -p, or an editor.

Verify

Re-run the two find commands; they print nothing you haven't already justified.

Example

The README forbids audio and video files. The find lists 40 .mp3 files under /home/bob/Music, /home/bob/.cache/.m/, and /var/backups/. All go. The secrets grep finds /home/alice/Desktop/passwords.txt with the team's logins and /var/www/html/db_backup.sql with customer records; both are deleted, and the passwords in the first file are changed because they're now known.

Try it

1. Hide an .mp3 under ~/.local/share and a passwords.txt in /var/tmp, then find both.
2. Create a file whose name ends in a space and delete it with tab completion.

Build it

A findfiles.sh that takes extensions from a file and runs the find with the system-path exclusions. Print only; you delete by hand.

Next

Malware and Persistence