2

I found the following two different pattern in some hacked javascript files.

<!--2d3965-->  some code  <!--/2d3965-->

/*2d3965*/ some code /*/2d3965*/

I am able to remove the first pattern from the file using this command:

sed -i 's/<!--2d3965-->.*<!--\/2d3965-->//g' javascript_file.js

but not able to remove the second pattern using similar command:

sed -i 's/\/\*2d3965\*\/.\+\/\*\/2d3965\*\///g' javascript_file.js

What's correct syntax to remove the second pattern?

6
  • 1
    Wouldn't it be easier to just revert to your backups that you have in your version control system?
    – Zoredache
    Sep 12, 2013 at 17:44
  • The hackers were nice enough to mark exactly where they injected code? And you trust those markers? The only reasonable course of action is to restore from backups. Sep 12, 2013 at 17:52
  • This is a common attack, actually.
    – ewwhite
    Sep 12, 2013 at 17:53
  • Yes, I have the backup. Just want to setup a monitor script to delete those code immediately when it find it.
    – garconcn
    Sep 12, 2013 at 18:00
  • 1
    Seriously? You think the next compromise will look identical to the last one? Wouldn't a better check be to calculate a cryptography hashs of the files, and watch for changes? That combined with actually identifying and fixing the vulnerability so it can't happen again?
    – Zoredache
    Sep 12, 2013 at 18:13

1 Answer 1

2

The code I've used for this type of attack on .php, .js and .html files is:

perl -p -i.orig -0 -e 's/<\?\s*#([0-9a-z]{6})#.*#\/\1#\s*\?>//gs; s/<\!--([0-9a-z]{6})-->.*<!--\/\1-->//gs;'

Annoying... You should figure out how the attacker got in and check the health of your backups as well. I had to run the above on 4 million files once because the backups were also tainted.

1
  • @garconcn Did this work?
    – ewwhite
    Sep 13, 2013 at 12:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .