Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our server was attacked and I need to delete a malicious code that was injected in lots of php and html files.

What is a good way to replace code from multiple files? I've tried using this script: https://github.com/terry81/Malicious-Web-Scripts-Search/commit/2cdb95adfb667455080468ccaa3e58c822c2bd32 but I cannot make it work. Please help!

share|improve this question
8  
How old is your most recent known good backup? –  Scott Pack Jan 27 '11 at 20:04
10  
I would never trust that server ever again. A wipe and rebuild seems to be in order here. –  joeqwerty Jan 27 '11 at 20:07
    
The short answer to your question is search-and-replace, using any text tool you prefer for the task. The correct answer is what joeqwerty wrote. –  John Gardeniers Jan 27 '11 at 21:51
1  
What's the point of deleting the malicious code if you do nothing to avoid having it back later? You could automate the removal via cronjob, but I'm sure you understand this is a joke. –  halp Jan 27 '11 at 22:15
1  
Nuke it from orbit and restore from backup. –  Chris S Jan 28 '11 at 0:56
add comment

5 Answers

up vote 0 down vote accepted

The script you linked seems quite simple. You can do something like this by the following one-liner:

find $DIRS -print0 | xargs -0 perl -p -i.bak -e 's/\Qcode to be removed\E//'

Here $DIRS stand for the directories you have your files in and code to be removed stands for the malicious code. The \Q will quote any special characters up to the \E. The original files are backuped into .bak files. If you do not want this remove the .bak, i.e. only -i, but do not combine it with -e, i.e. -i -e not -ie.

BE CAREFUL YOU MIGHT DELETE IMPORTANT STUFF IF YOU DO IT WRONG! MAKE BACKUPS BY YOURSELF FIRST!

Update:

Script version:

#!/usr/bin/env perl -i.bak
use strict;
use warnings;

my $code = <<'END-OF-MALICIOUS-CODE';
xo=new Date(2010,11,3,2,21,4);t=xo.getSeconds();var huur=[36/t,36/t, ....
END-OF-MALICIOUS-CODE
chomp $code; # remove trailing newline

while (<>) {
    s/\Q$code\E//;
    print;
}

But this into a file, best with a .pl extension, e.g. remcode.pl. Optionally make it executable (chmod +x file.pl), otherwise you have to call it with perl explicitly:

find $DIRS -print0 | xargs -0 perl remcode.pl

You could do the 'find' part as well as perl code, but that it not needed.

No guarantees! Test it on a couple of files first!

share|improve this answer
1  
Note that trying this from the command line will probably be an exercise in frustration if your "code to be removed" contains single quotes (or worse yet, a mix of single and double quotes). –  larsks Jan 27 '11 at 20:12
    
@larsks, agreed, for more complicated code a small script file is required. –  Martin Scharrer Jan 27 '11 at 20:14
    
Yeah, my code has al sorts of single quotes and every character you can think of. If you want to take a look: catch.com/m/BVtfI/9eAmrI89SVl How would I do this in a script file? –  ooops Jan 27 '11 at 21:23
add comment

Sed, Perl, etc. could all do what you want. However...

I would not assume that someone was able to inject malicious code into lots of scripts and hasn't totally owned the box. Sure, you get rid of malicious code in the HTML, but what about the botnet that's running from your box?

Standard procedure is to pull the box off the network and do a full postmortem before plugging it back in. At the very least, if you've been keeping checksums with your backups, run the checksums of the entire filesystem.

You'd probably be safest to restore from your last known good backups - but that's only if you can positively identify the date and time of initial compromise from archived logs, etc.

share|improve this answer
add comment

There are lots of ways to find and replace text across multiple files. Sed is a favorite, but whether it's the right tool or not depends a lot on what your files look like. Can you give us an example of the malicious code in context?

share|improve this answer
    
Yeah, of course. The malicious code is this: catch.com/m/BVtfI/9eAmrI89SVl –  ooops Jan 27 '11 at 20:09
add comment

Ultra Edit is one of the better editing tool. You can google and download a trial version to try it out. If there's a backup exist for your server then I'd recommend using Beyond Compare to analyze and restore the files. please note that these tools that I mention are not free ware.

share|improve this answer
add comment

You can easily fix (or completely mangle) lots of files with this:

sudo perl -pi.prev -e 's/bad string/new string/g' /path/to/folder/of/bad/files

Of course, now you need a regex to match the bad code, so you have two problems.

It will make a copy of each file with .prev at the end, then replace as shown in the original file.

**

  • TEST YOUR REGEX CAREFULLY FIRST !!!

**

share|improve this answer
    
This does not handle all files and subdirs recursively, does it? –  Martin Scharrer Jan 28 '11 at 0:37
    
Nope - You're absolutely correct - see Martin's more complete answer using this in combination with find to add recursion. –  furicle Feb 19 '11 at 20:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.