0

I need to run a command to grep one of these strings from command line as web host disabled account to run website from browser until virus files are removed and I managed to collect few strings that can find those files.

I would appreciate if someone knows if I can run a command for this.

Text to find:

bigdeal777
Goog1e_analist_certs.*
tevq\(ucyq\)
GR_HOST_ID.*
\['cmd'\]
ejppy.*
eval\(gzinflate.*
eval\(base64_decode.*
FilesMan.*
Web Shell by.*
Goog1e_analist_up.*
palcastle.*
shell_exec
google_analytics_obh.*
udb=1
createCSS.*
base64_decode\(str_replace
exit;move_uploaded_file
msgz.*
iskandar.*
\.sterling.*
CLaW.*
feoMEN.*
Hacke.*
into [a-z0-9\-_]{1,}orders
gagal
JSinj
linkonline
SUKS.*
\@system\(
\@passthru\(
\@popen\(
Mohajer22
\@extract\(
likecinema
mp3aim
mixmenow
lyricsoasis
PGlmcmFtZSBzcmM9Imh0dHA6Ly93d3cubC1jb3VudGVyLmNvbS9zdGF0cy5waHA\/aWQ9
\$_POST\[\'skip\'\]
u0058
urlencode\(strrev
viagra.*

I just need to know full path to the matching file.

Thank You.

1

If you can put those in a file you can use grep's -f flag to read the patterns from a file and you can use -l to show just the files that have a match

Putting those together you can do something like

grep -R -l -f scanner.txt *

So the -R will cause it to search recursively (I'm assuming you want that), -l will print just the names of the files that contain a match, and -f says to read the search patterns from the file scanner.txt

  • what will command look like if string filename is scanner.txt. thanks. – Damodar Bashyal Apr 30 '15 at 1:19
  • Edited to reflect a command to try – Eric Renouf Apr 30 '15 at 1:21
  • updated string above that i am using now. and i got this error: grep: Unmatched ( or \(. Can you please try and let me know if you see same error or works for you. Thanks. – Damodar Bashyal Apr 30 '15 at 1:29
  • It's trying to interpret the patterns as regex, but you could also add -F to tell it not to (though you may want to get rid of a lot of the .* and similar in those patterns then) Remember that it will already match anything on the line, so don't need to tell it to match "whatever comes after it" you get that for free – Eric Renouf Apr 30 '15 at 1:39
  • 1
    Thanks. grep -R -l -F -f ../scanner.txt * did the trick :) – Damodar Bashyal Apr 30 '15 at 1:45
0

I think it can helps you :

#!/bin/bash
declare arr=('bigdeal777',
    'Goog1e_analist_certs.*',
    'tevq\(ucyq\)',
    'GR_HOST_ID.*',
    "\['cmd'\]",
    'ejppy.*',
    'eval\(gzinflate.*',
    'eval\(base64_decode*.',
    'FilesMan*.',
    'Web Shell by.*',
    'Goog1e_analist_up.*',
    'palcastle.*',
    'shell_exec',
    'google_analytics_obh.*',
    '"udb=1"',
    'createCSS.*',
    'base64_decode\(str_replace',
    'exit;move_uploaded_file',
    'msgz.*',
    'iskandar.*',
    '\.sterling.*',
    'CLaW.*',
    'feoMEN.*',
    'Hacke.*',
    'into [a-z0-9\-_]{1,}orders',
    'gagal',
    'JSinj',
    'linkonline',
    'SUKS.*',
    '\@system\(',
    '\@passthru\(',
    '\@popen\(',
    'Mohajer22',
    '\@extract\(',
    'likecinema',
    'mp3aim',
    'mixmenow',
    'lyricsoasis',
    'PGlmcmFtZSBzcmM9Imh0dHA6Ly93d3cubC1jb3VudGVyLmNvbS9zdGF0cy5waHA\/aWQ9',
    "\$_POST\[\'skip\'\]",
    'u0058',
    'urlencode\(strrev',
    'viagra.*');
arr_size=${#arr[@]};
for i in `seq 1 $arr_size` ; do 
    echo ${arr[$i]}|egrep -i "$1" ;
done;

Usage :

./script.sh eval
  • sh script.sh prints those string and ./script.sh eval i get permission denied message. – Damodar Bashyal Apr 30 '15 at 2:06
  • chmod +x script.sh – PersianGulf Apr 30 '15 at 19:56
  • Thx. Now I am getting this: eval\(gzinflate.*, eval\(base64_decode*., – Damodar Bashyal May 1 '15 at 0:19
  • Now, you can up vote... – PersianGulf May 1 '15 at 0:49
  • Sorry, I don't have enough score to vote up. But with the issue, it's not finding files with those strings though. I added one file with strings, but it can't find that. I think, the script fails at eval line? – Damodar Bashyal May 1 '15 at 1:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.