My shared host got hacked and I need to check my PHP scripts for backdoors. I'm on a dedicated server now so I can use SSH to run scripts. Are there any good scripts out there to do this task?
4 Answers
That is going to be a tough one. I doubt there are scripts that check for Php backdoors or even if it does can weed out all them. It will be best if you can restore using a known good backup.
Change your passwords, including that of DB. Audit the host.
-
2+1 restore from backup. Without looking over every line of code, you can't be sure that you're clear of exploits.– NicJan 24, 2011 at 3:51
ClamAV does a pretty good job on this. It doesn't just look for Windows viruses. Depending on your environment something like the following;
Plesk: freshclam; clamscan -ir /home/httpd/vhosts/*/httpdocs/ | tee ~/possible.phpshells
cPanel: freshclam; clamscan -ir /home//public_html/ | tee ~/possible.phpshells
I use to use the following as until I found that clam did a good job. There are just too many of these to keep up with:
find /home/*/public_html/ -size -200k -type f -print0 | xargs -0 grep -iE "r57shell|c99shell|g00nshell|EgY_SpIdEr|egy_spider|phpjackal" | uniq -c | sort -u | cut -d":" -f1 | awk '{ print $2 }' | uniq > /root/possible.phpshells
-
2This will almost certainly miss major vulnerabilities and will only flag known-scripts that have been picked up by clamav. When there's a compromise, the only guaranteed "safe" thing to do is to restore from a known-good backup. Jan 24, 2011 at 3:58
-
Well if he is wanting to find scripts and possibly gain a better understanding how the scripts were uploaded clamav is a good tool to do that before the obvious restore backups.– GlenJan 24, 2011 at 12:11
maldet might be good to run. It may detect things that clamscan doesn't. For example, it picks up the common 'eval(base64_decode' pattern.
However, I wouldn't trust any code that was from that host. Restoring from backup is really your best bet.
If anyone is still looking for an answer to this, there is a great free PHP utility that you can run on your server to find base64 encoded strings, and several other common shell strings.
The utility is called PHP Shell Detector.
-
Welcome to Server Fault. Unfortunately, new users are restricted in posting links. (This restriction is removed when you get to 10 reputation.) I've added a link to the official site for the utility that you referenced. Oct 7, 2012 at 3:15