2

A hacker got into a web server and added this string (removed some characters for security purposes and added line breaks for readability) in all index.php files:

<?php 
eval(gzuncompress(base64_decode('eF5Tcffxd3L0CY5WjzcyNDGGMV4+1dSwqSqzU0LQGAJCPCMM='))); 
eval(gzuncompress(base64_decode('eF5LK81LLsnMzKx+JjNW0rgUAqDUUxQ==')));  
eval(gzuncompress(base64_decode('eF6VlMmy/3sMxOez/iJOojHFT0Ig/8jlTymmN/I='))); 
?>

I have tried using the sed command to remove it (replacing it with nothing) but it is nearly impossible to define a working regular expression with such a huge string.

Is there another way, maybe reading the string from a .txt file?

1

Assumung you don't use these tricks anywhere, why not this (appropriately executed, using sed -i and maybe find -exec ..., which was not part of your question, was it?)

$ sed 's/eval(gzuncompress(base64_decode(.*)));//' << EOF                     
> <?php eval(gzuncompress(base64_decode('eF5Tcffxd3L0CY5WjzcyNDGGMV4+1dSwqSqzU0LQGAJCPCMM=')));eval(gzuncompress(base64_decode('eF5LK81LLsnMzKx+JjNW0rgUAqDUUxQ=='))); eval(gzuncompress(base64_decode('eF6VlMmy/3sMxOez/iJOojHFT0Ig/8jlTymmN/I=')));?>
> EOF
<?php  ?>

...you can afterwards deal with the empty <?php ?>s (which don't hurt much, do they?).

Edit removed line breaks to make sure it fits to the situation described.

Edit2 You'd be better off just replacing everything with a (known good) backup, probably, if you've got one.

Edit3 I just caught the "all index.php files" bit. You can thus try something like

find /path/to/wwwroot -name "index.php" -exec sed -i regex {} \;
  • I have used some backups but for some files I had to do it this way. Thanks sr_! It worked great. – Kenzier Nov 15 '11 at 11:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.