2

I found the following two different pattern in some hacked javascript files.

<!--2d3965-->  some code  <!--/2d3965-->

/*2d3965*/ some code /*/2d3965*/

I am able to remove the first pattern from the file using this command:

sed -i 's/<!--2d3965-->.*<!--\/2d3965-->//g' javascript_file.js

but not able to remove the second pattern using similar command:

sed -i 's/\/\*2d3965\*\/.\+\/\*\/2d3965\*\///g' javascript_file.js

What's correct syntax to remove the second pattern?

  • 1
    Wouldn't it be easier to just revert to your backups that you have in your version control system? – Zoredache Sep 12 '13 at 17:44
  • The hackers were nice enough to mark exactly where they injected code? And you trust those markers? The only reasonable course of action is to restore from backups. – 200_success Sep 12 '13 at 17:52
  • This is a common attack, actually. – ewwhite Sep 12 '13 at 17:53
  • Yes, I have the backup. Just want to setup a monitor script to delete those code immediately when it find it. – garconcn Sep 12 '13 at 18:00
  • 1
    Seriously? You think the next compromise will look identical to the last one? Wouldn't a better check be to calculate a cryptography hashs of the files, and watch for changes? That combined with actually identifying and fixing the vulnerability so it can't happen again? – Zoredache Sep 12 '13 at 18:13
2

The code I've used for this type of attack on .php, .js and .html files is:

perl -p -i.orig -0 -e 's/<\?\s*#([0-9a-z]{6})#.*#\/\1#\s*\?>//gs; s/<\!--([0-9a-z]{6})-->.*<!--\/\1-->//gs;'

Annoying... You should figure out how the attacker got in and check the health of your backups as well. I had to run the above on 4 million files once because the backups were also tainted.

  • @garconcn Did this work? – ewwhite Sep 13 '13 at 12:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.