I've seen this, they're not corrupt .cer files, they're an indicator/evidence that your hosting has been compromised and hacked.
You'll see random files that have reserved/forbidden names/extentions such as LPT1.***.cer, the contents of the .cer file will later be replaced with ASP. They use these reserved/forbidden names because they're hard to delete. There are lots of other reserved names that you'll see too like CON.***.cer, COM1.***.cer, LPT2.***.cer etc. You can read more about this technique here
https://book.hacktricks.xyz/pentesting-web/file-upload
They want these files to remain on the server for as long as possible which is why they user reserved names, you wont be able to delete these files via FTP or even via the desktop. NTFS will not allow deletion of reserved names via native utilities, so you have to fool NTFS into not doing reserve-word checking with DEL \\.\D:\PATHTOFILE\LPT1.6E0pJTWq.cer
I've had to write special command prompt/batch files to search for and delete these files.
For example, this will find all files with the extension .cer and then loop through those files looking to see if it contains LTP1 in the filename. You would substitute \inetpub to \vhosts
Code:
FOR /R "D:\inetpub" %%# in (*.cer) DO (
ECHO %%~nx# | FIND "%pattern%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
)
Below is my complete script for .cer files, you'll need to duplicate it for .asp, .aspx and .config (these are other extensions they use other than .cer) and I've added these batch scripts into windows task scheduler which execute each night. This script works for my purposes and has been tested only on my servers, so although I'm confident it's safe in my environment it hasn't been widely tested and as such if you decide to use it it's at your own risk.
Code:
SET "patterncon=CON"
SET "pattern=LPT1"
SET "pattern2=LPT2"
SET "pattern3=LPT3"
SET "pattern4=LPT4"
SET "pattern5=LPT5"
SET "pattern6=LPT6"
SET "pattern7=LPT7"
SET "pattern8=LPT8"
SET "pattern9=LPT9"
SET "pattern10=AUX"
SET "pattern11=CON"
SET "pattern12=PRN"
SET "pattern13=COM1"
SET "pattern14=COM2"
SET "pattern15=COM3"
SET "pattern16=COM4"
SET "pattern17=COM5"
SET "pattern18=COM6"
SET "pattern19=COM7"
SET "pattern20=COM8"
SET "pattern21=COM9"
SET "pattern22=nul"
SET "pattern23=NUL"
FOR /R "D:\inetpub" %%# in (*.cer) DO (
ECHO %%~nx# | FIND "%patterncon%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern2%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern3%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern4%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern5%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern6%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern7%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern8%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern9%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern10%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern11%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern12%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern13%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern14%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern15%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern16%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern17%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern18%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern19%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern20%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern21%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern22%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
ECHO %%~nx# | FIND "%pattern23%" 1>NUL && (
Echo \\.\%%#
del \\.\%%#
)
)
Facebook
Twitter
Thanks,