0

My shared host got hacked and I need to check my PHP scripts for backdoors. I'm on a dedicated server now so I can use SSH to run scripts. Are there any good scripts out there to do this task?

1
  • Most of the comments you've received are accurate in that you should not copy compromised code (you didn't specify whether you had) - perhaps you could add that detail?
    – danlefree
    Jan 24, 2011 at 8:26

4 Answers 4

3

That is going to be a tough one. I doubt there are scripts that check for Php backdoors or even if it does can weed out all them. It will be best if you can restore using a known good backup.

Change your passwords, including that of DB. Audit the host.

1
  • 2
    +1 restore from backup. Without looking over every line of code, you can't be sure that you're clear of exploits.
    – Nic
    Jan 24, 2011 at 3:51
2

ClamAV does a pretty good job on this. It doesn't just look for Windows viruses. Depending on your environment something like the following;

Plesk: freshclam; clamscan -ir /home/httpd/vhosts/*/httpdocs/ | tee ~/possible.phpshells

cPanel: freshclam; clamscan -ir /home//public_html/ | tee ~/possible.phpshells

I use to use the following as until I found that clam did a good job. There are just too many of these to keep up with:

find /home/*/public_html/ -size -200k -type f -print0 | xargs -0 grep -iE "r57shell|c99shell|g00nshell|EgY_SpIdEr|egy_spider|phpjackal" | uniq -c | sort -u | cut -d":" -f1 | awk '{ print $2 }' | uniq > /root/possible.phpshells

2
  • 2
    This will almost certainly miss major vulnerabilities and will only flag known-scripts that have been picked up by clamav. When there's a compromise, the only guaranteed "safe" thing to do is to restore from a known-good backup.
    – Scrivener
    Jan 24, 2011 at 3:58
  • Well if he is wanting to find scripts and possibly gain a better understanding how the scripts were uploaded clamav is a good tool to do that before the obvious restore backups.
    – Glen
    Jan 24, 2011 at 12:11
0

maldet might be good to run. It may detect things that clamscan doesn't. For example, it picks up the common 'eval(base64_decode' pattern.

However, I wouldn't trust any code that was from that host. Restoring from backup is really your best bet.

0

If anyone is still looking for an answer to this, there is a great free PHP utility that you can run on your server to find base64 encoded strings, and several other common shell strings.

The utility is called PHP Shell Detector.

1
  • Welcome to Server Fault. Unfortunately, new users are restricted in posting links. (This restriction is removed when you get to 10 reputation.) I've added a link to the official site for the utility that you referenced. Oct 7, 2012 at 3:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .