sed -ri  '1 s/.*<\?php \$xgzdxgn.*\$tdjwdrzy.*\$vbtpmtzqq-1; \?>//g' *.php

How to run this command on folders and sub-folders in a single command ( for all php files ). when i try to use this commend only apply for current directory, sorry for my lack of knowledge :(

  • this is not a duplication question – Shanu T Thankachan Dec 30 '17 at 9:27
  • find . -regex *.php -exec sed -ri '1 s/.../.../g' {} + – Kondybas Dec 30 '17 at 9:44
  • @Kondybas 'find: paths must precede expression' – Shanu T Thankachan Dec 30 '17 at 10:19

You shouldn't try to fix your compromised server with a bandaid like this. You still have the original vulnerability on the server, and your server is still owned by the attackers.

The only reliable way is to restore from good known backups and then applying all available OS upgrades. Of course if you have a version which is EOL, then you need to upgrade the whole OS.

  • i have no backups, i am moving to another server @tero-kilkanen – Shanu T Thankachan Jan 1 '18 at 7:30
  • If this is an application you have made yourself directly on the server, it is a horrible practice. Otherwise you implicitly have backups of the code that are clean, and you should use them. Then study all the other files of the application on the server to make sure they are clean. And most importantly, make a backup and disaster recovery plan for the future. – Tero Kilkanen Jan 1 '18 at 12:33

The sed utility cannot do this on it's own as it has no recurse through directories option. Instead, you have to do something that finds the files and feeds them into sed, something like

find /path/to/start -type f -name '*.php' -print 0 | xargs -0 sed -ri  '1 s/.*<\?php \$xgzdxgn.*\$tdjwdrzy.*\$vbtpmtzqq-1; \?>//g'

should do the trick. It's probably a good idea to test that without the -i before blindly running it.

  • what about this ? find . -type f -print0 | xargs -0 sed -ri '1 s/.*<\?php \$xgzdxgn.*\$tdjwdrzy.*\$vbtpmtzqq-1; \?>//g' *.php – Shanu T Thankachan Dec 30 '17 at 10:39
  • I don't care about the actual sed command, I answered your question about ow to do it recursively. – user9517 supports GoFundMonica Dec 30 '17 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.