Uh… kinda? Powershell has many POSIX aliases to cmdlets (equivalent to shell built-ins) of allegedly the same functionality. rmdir and rm are both aliases of Remove-Item, ls is Get-ChildItem, cd is Set-Location, cat is Get-Content, and so on.
Of particular note is curl. Windows supplies the real CURL executable (System32/curl.exe), but in a Powershell 5 session, which is still the default on Windows 11 25H2, the curl alias shadows it. curl is an alias of the Invoke-WebRequest cmdlet, which is functionally a headless front-end for Internet Explorer unless the -UseBasicParsing switch is specified. But since IE is dead, if -UseBasicParsing is not specified, the cmdlet will always throw an error. Fucking genius, Microsoft.
Yeah as an admin I love that I can run familiar Linuxy commands in powershell but I also hate that they can’t just use/fork the real userland utilities so everything works just similarly enough to completely throw you off when you stumble across a difference
“rd” and “rmdir” only work on empty directories in MS-DOS (and I assume, by extension, in Windows shell). “deltree” is for nuking a complete tree including files, as the name suggests.
In the original Reddit post it’s mentioned that the agent ran “rmdir /s” which does in fact work on directories containing files and/or subdirectories.
Windows has
rmdir?Uh… kinda? Powershell has many POSIX aliases to cmdlets (equivalent to shell built-ins) of allegedly the same functionality.
rmdirandrmare both aliases ofRemove-Item,lsisGet-ChildItem,cdisSet-Location,catisGet-Content, and so on.Of particular note is
curl. Windows supplies the real CURL executable (System32/curl.exe), but in a Powershell 5 session, which is still the default on Windows 11 25H2, thecurlalias shadows it.curlis an alias of theInvoke-WebRequestcmdlet, which is functionally a headless front-end for Internet Explorer unless the-UseBasicParsingswitch is specified. But since IE is dead, if-UseBasicParsingis not specified, the cmdlet will always throw an error. Fucking genius, Microsoft.Jesus, They really just need to start over.
Yeah as an admin I love that I can run familiar Linuxy commands in powershell but I also hate that they can’t just use/fork the real userland utilities so everything works just similarly enough to completely throw you off when you stumble across a difference
That’s hilarious
https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/rmdir
Apparently.
“rd” and “rmdir” only work on empty directories in MS-DOS (and I assume, by extension, in Windows shell). “deltree” is for nuking a complete tree including files, as the name suggests.
In the original Reddit post it’s mentioned that the agent ran “rmdir /s” which does in fact work on directories containing files and/or subdirectories.
“rmdir /s” - /s for sarcasm
“Where the fuck is all my data?”
Wait, what do people use other than rmdir?
Windows explorer
I don’t have a Windows computer on hand, but I think
delworks on directories? I’m going by very old memories hereDel is files, Rmdir is directories.
Running del on folders just leaves an empty tree.