Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My shared host got hacked and I need to check my PHP scripts for backdoors. I'm on a dedicated server now so I can use SSH to run scripts. Are there any good scripts out there to do this task?

share|improve this question
    
Most of the comments you've received are accurate in that you should not copy compromised code (you didn't specify whether you had) - perhaps you could add that detail? –  danlefree Jan 24 '11 at 8:26

4 Answers 4

That is going to be a tough one. I doubt there are scripts that check for Php backdoors or even if it does can weed out all them. It will be best if you can restore using a known good backup.

Change your passwords, including that of DB. Audit the host.

share|improve this answer
2  
+1 restore from backup. Without looking over every line of code, you can't be sure that you're clear of exploits. –  Nic Jan 24 '11 at 3:51

ClamAV does a pretty good job on this. It doesn't just look for Windows viruses. Depending on your environment something like the following;

Plesk: freshclam; clamscan -ir /home/httpd/vhosts/*/httpdocs/ | tee ~/possible.phpshells

cPanel: freshclam; clamscan -ir /home/*/public_html/* | tee ~/possible.phpshells

I use to use the following as until I found that clam did a good job. There are just too many of these to keep up with:

find /home/*/public_html/ -size -200k -type f -print0 | xargs -0 grep -iE "r57shell|c99shell|g00nshell|EgY_SpIdEr|egy_spider|phpjackal" | uniq -c | sort -u | cut -d":" -f1 | awk '{ print $2 }' | uniq > /root/possible.phpshells

share|improve this answer
2  
This will almost certainly miss major vulnerabilities and will only flag known-scripts that have been picked up by clamav. When there's a compromise, the only guaranteed "safe" thing to do is to restore from a known-good backup. –  Scrivener Jan 24 '11 at 3:58
    
Well if he is wanting to find scripts and possibly gain a better understanding how the scripts were uploaded clamav is a good tool to do that before the obvious restore backups. –  Glen Jan 24 '11 at 12:11

maldet might be good to run. It may detect things that clamscan doesn't. For example, it picks up the common 'eval(base64_decode' pattern.

However, I wouldn't trust any code that was from that host. Restoring from backup is really your best bet.

share|improve this answer

If anyone is still looking for an answer to this, there is a great free PHP utility that you can run on your server to find base64 encoded strings, and several other common shell strings.

The utility is called PHP Shell Detector.

share|improve this answer
    
Welcome to Server Fault. Unfortunately, new users are restricted in posting links. (This restriction is removed when you get to 10 reputation.) I've added a link to the official site for the utility that you referenced. –  Michael Hampton Oct 7 '12 at 3:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.