I am trying to find scripts that contain common malicious code, I need to match multiple strings within each file. What I am using is working but am not sure why I get the following in the output:

# egrep -rli --include='*.php' 'return base64_decode' . | xargs -0 grep -l 'isset'
grep: ./wp-content/themes/twentyfourteen/js/menu61.php
: No such file or directory

The output is good and is what I want but why does it show on line 1:

grep: ./wp-content/themes/twentyfourteen/js/menu61.php

and the last line always shows:

: No such file or directory

and lastly, piping it into a file doesn't work.

# egrep -rli --include='*.php' 'return base64_decode' . | xargs -0 grep -l 'isset' >> asd

What you're looking at is not a result, it's an error message. The format of grep's error when told to search through a non-existent file is grep: file name: No such file or directory. For example:

$ grep foo bar
grep: bar: No such file or directory

That's why you get the grep: at the beginning and the No such file or directory at the end. That is also why you can't redirect the output to a file, it's being printed to standard error, not standard output and you are redirecting the latter. You can save the output by using 2>> instead of >>. That, however, is not what you want since these are errors.

Your problem is that you're using -0 with xargs which tells it to expect null-separated data. Since your data is actually separated by newlines (each file is on a single line), xargs tells grep to look for a file of that name (the entire multiline set). What you want to do instead is:

 grep -Erli --include='*.php' 'return base64_decode' . | xargs grep -l 'isset'

Or, if your file names can contain newlines and you have a version of grep that supports it, use grep's -Z flag to produce null-separated output:

grep -ZErli --include='*.php' 'return base64_decode' . | xargs -0 grep -l 'isset'

Also note that I use grep -E instead of egrep. The egrep and fgrep are deprecated in favor of grep -E and grep -F, respectively.


Try running xargs without the -0 parameter. That parameter tells xargs to expect nul-separated arguments, which isn't the case here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.