0

Short and sweet: One of my hosting subscriptions got hacked.

I ran this command: find path-to-folder/ -mtime -7 -name "*.php" –print this produced about 11 pages worth of malicious code which was added on Jan. 30th. I don’t want to individually delete all these items but rather create a script or create a command to perform the delete task once.

I’d like to accomplish one of the following:

  1. create a script which will delete files based on the paths I enter into a linked .txt file - OR
  2. a single command to delete all file with a -name “*.php” from a given folder based on a specific date range? Kind of tweaking the command from above - if this is possible??.
  • 1
    what about the find -delete flag ? – 把友情留在无盐 Feb 1 '15 at 2:35
  • 1
    This is fairly easy to do with find and someone will be undoubtedly be along soon with that, but do note that it's possible to change modification dates to whatever you want — there's no guarantee that other files weren't modified too, so this doesn't really secure anything. – Michael Homer Feb 1 '15 at 2:36
  • when we have much more bad files than good files , maybe we have to write a whitelist instead of blacklist . and MichaelHomer is right , we are not secure . – 把友情留在无盐 Feb 1 '15 at 3:00
  • ahh..thanks for help here’s what I finally came up with: – nak_attack Feb 1 '15 at 16:40
  • find . -type f -name "*.php" -newermt 2015-01-28 ! -newermt 2015-01-31 -ls – nak_attack Feb 1 '15 at 16:42
2
  1. the answer from Poisson Aerohead is basically good , with a small modification that we have better use NULL as filename delimetre .

  2. to do this in one command we just change the -print to the -delete . be careful the -delete switch have to be the last switch , or files get deleted before they are checked against other remaining switches .

    find path-to-folder/ -mtime -7 -name "*.php" –delete

1

Also short and sweet: cat list | xargs rm

This assumes that you have a file named 'list' of all the malicious .php files and that you are in the directory containing the .php files (just to be clear, but I bet you already understood that).


If any of the filenames contain newlines, this will be dangerous to run, particularly because you already know they have been constructed by a malicious adversary. If you have the list of filenames in a text file you can check the list in advance and make sure that none of the lines will delete files you want to preserve.

Additionally, if the attacker managed to get malicious php scripts onto this host, this may not be your biggest problem. I am only answering the question you posed, and @soubunmei gave a better answer because she knew a bit more about the find command than me, but neither answer guarantees security. Sorry if that was not clear and thanks to @soubunmei and @MichaelHomer for pointing out my careless language. You should talk to a cyber security professional if you believe someone malicious may have attained elevated privileges on the host.


I personally suspect there is a nice "extension and date" based way to do it, as you asked, that some people may find more elegant, but since you already have the list, why not use it?

I tested this on a file named 'list' that contained the lines:

file1
file2

and these files were on my desktop. It worked as expected. I strongly recommend you test this on a small stage first to see how it will behave, and also backup the directory before any mass file removals. Hard drive space is much cheaper than programmers' time!

  • be sure to use find -print0 and xargs -0 if we want to deal with filenames without prior knowledge . because arbitary characters in the filename can be dangerous to handle . – 把友情留在无盐 Feb 1 '15 at 2:39
  • To help with my own ignorance, is this to watch out for newlines in the file names? – Poisson Aerohead Feb 1 '15 at 2:42
  • In the circumstances cat list | xargs rm is incredibly dangerous (because of possible newlines in filenames, yes) and you definitely should not run it. – Michael Homer Feb 1 '15 at 2:51
  • OK thanks, although in the circumstances he has a list of the file names so I'm not sure we are totally without prior knowledge. Also, his original find command then needs to be rerun to delimit with 0 as well. – Poisson Aerohead Feb 1 '15 at 2:53
  • a 11 page list isn't something of good knowledge . who have this energy to examine that one by one ? – 把友情留在无盐 Feb 1 '15 at 2:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.