2

Our server was attacked and I need to delete a malicious code that was injected in lots of php and html files.

What is a good way to replace code from multiple files? I've tried using this script: https://github.com/terry81/Malicious-Web-Scripts-Search/commit/2cdb95adfb667455080468ccaa3e58c822c2bd32 but I cannot make it work. Please help!

5
  • 8
    How old is your most recent known good backup?
    – Scott Pack
    Jan 27, 2011 at 20:04
  • 10
    I would never trust that server ever again. A wipe and rebuild seems to be in order here.
    – joeqwerty
    Jan 27, 2011 at 20:07
  • The short answer to your question is search-and-replace, using any text tool you prefer for the task. The correct answer is what joeqwerty wrote. Jan 27, 2011 at 21:51
  • 1
    What's the point of deleting the malicious code if you do nothing to avoid having it back later? You could automate the removal via cronjob, but I'm sure you understand this is a joke.
    – halp
    Jan 27, 2011 at 22:15
  • 1
    Nuke it from orbit and restore from backup.
    – Chris S
    Jan 28, 2011 at 0:56

5 Answers 5

0

The script you linked seems quite simple. You can do something like this by the following one-liner:

find $DIRS -print0 | xargs -0 perl -p -i.bak -e 's/\Qcode to be removed\E//'

Here $DIRS stand for the directories you have your files in and code to be removed stands for the malicious code. The \Q will quote any special characters up to the \E. The original files are backuped into .bak files. If you do not want this remove the .bak, i.e. only -i, but do not combine it with -e, i.e. -i -e not -ie.

BE CAREFUL YOU MIGHT DELETE IMPORTANT STUFF IF YOU DO IT WRONG! MAKE BACKUPS BY YOURSELF FIRST!

Update:

Script version:

#!/usr/bin/env perl -i.bak
use strict;
use warnings;

my $code = <<'END-OF-MALICIOUS-CODE';
xo=new Date(2010,11,3,2,21,4);t=xo.getSeconds();var huur=[36/t,36/t, ....
END-OF-MALICIOUS-CODE
chomp $code; # remove trailing newline

while (<>) {
    s/\Q$code\E//;
    print;
}

But this into a file, best with a .pl extension, e.g. remcode.pl. Optionally make it executable (chmod +x file.pl), otherwise you have to call it with perl explicitly:

find $DIRS -print0 | xargs -0 perl remcode.pl

You could do the 'find' part as well as perl code, but that it not needed.

No guarantees! Test it on a couple of files first!

3
  • 1
    Note that trying this from the command line will probably be an exercise in frustration if your "code to be removed" contains single quotes (or worse yet, a mix of single and double quotes).
    – larsks
    Jan 27, 2011 at 20:12
  • @larsks, agreed, for more complicated code a small script file is required. Jan 27, 2011 at 20:14
  • Yeah, my code has al sorts of single quotes and every character you can think of. If you want to take a look: catch.com/m/BVtfI/9eAmrI89SVl How would I do this in a script file?
    – ooops
    Jan 27, 2011 at 21:23
2

Sed, Perl, etc. could all do what you want. However...

I would not assume that someone was able to inject malicious code into lots of scripts and hasn't totally owned the box. Sure, you get rid of malicious code in the HTML, but what about the botnet that's running from your box?

Standard procedure is to pull the box off the network and do a full postmortem before plugging it back in. At the very least, if you've been keeping checksums with your backups, run the checksums of the entire filesystem.

You'd probably be safest to restore from your last known good backups - but that's only if you can positively identify the date and time of initial compromise from archived logs, etc.

1

There are lots of ways to find and replace text across multiple files. Sed is a favorite, but whether it's the right tool or not depends a lot on what your files look like. Can you give us an example of the malicious code in context?

1
1

Ultra Edit is one of the better editing tool. You can google and download a trial version to try it out. If there's a backup exist for your server then I'd recommend using Beyond Compare to analyze and restore the files. please note that these tools that I mention are not free ware.

0

You can easily fix (or completely mangle) lots of files with this:

sudo perl -pi.prev -e 's/bad string/new string/g' /path/to/folder/of/bad/files

Of course, now you need a regex to match the bad code, so you have two problems.

It will make a copy of each file with .prev at the end, then replace as shown in the original file.

**

  • TEST YOUR REGEX CAREFULLY FIRST !!!

**

2
  • This does not handle all files and subdirs recursively, does it? Jan 28, 2011 at 0:37
  • Nope - You're absolutely correct - see Martin's more complete answer using this in combination with find to add recursion.
    – furicle
    Feb 19, 2011 at 20:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .