0

Here is the script:


<?php
//Create back files?
define('CREATE_BACKUPS', FALSE);

if (!is_dir($argv[1]))
{
   echo "You must enter a valid path such as /home/apresv/public_html or apresv/public_html for this script to function.\n";
   exit;
}

//Search the path for all php files, opening each one, and checking to see if it's infected

//First, get an array list of all valid .php files.


$files = listdir($argv[1]);
foreach ($files as $filename)
{
   //We only need to check php files, so we add that here
   if (file_extension($filename) == 'php')
   {
      //This is a php file so lets check it to see if it's infected.
      $contents = file_get_contents($filename);
      $backup = $contents;

      //There will always be 2 opening tags in an infected file and since the hack is always at the top, it's easiest to test for this right away.
      $test = between('<?php', '<?php', $contents);

      //This particular hack likes to use toolbarqueries so we test to see if our chunk is an infected chunk.  If your website uses this url somehow, then add extra if statements as necessary.
      if (after('toolbarqueries', $test))
      {
         //This chunk is infected.  So lets replace it and resave the file.
         $contents = str_replace('<?php'.$test.'<?php', '<?php', $contents);

         //Now save it! Woohoo!
         file_put_contents($filename, $contents);
         if (CREATE_BACKUPS)
         {
            file_put_contents($filename.'.orig', $backup);
         }

         echo "$filename has been cleaned.\n";
      }
   }
}

function after ($this, $inthat)
    {
        if (!is_bool(strpos($inthat, $this)))
        return substr($inthat, strpos($inthat,$this)+strlen($this));
    };

    function after_last ($this, $inthat)
    {
        if (!is_bool(strrevpos($inthat, $this)))
        return substr($inthat, strrevpos($inthat, $this)+strlen($this));
    };

    function before ($this, $inthat)
    {
        return substr($inthat, 0, strpos($inthat, $this));
    };

    function before_last ($this, $inthat)
    {
        return substr($inthat, 0, strrevpos($inthat, $this));
    };

    function between ($this, $that, $inthat)
    {
     return before($that, after($this, $inthat));
    };

    function between_last ($this, $that, $inthat)
    {
     return after_last($this, before_last($that, $inthat));
    };

    // USES
    function strrevpos($instr, $needle)
    {
        $rev_pos = strpos (strrev($instr), strrev($needle));
        if ($rev_pos===false) return false;
        else return strlen($instr) - $rev_pos - strlen($needle);
    };

    function listdir($dir='.') {
    if (!is_dir($dir)) {
        return false;
    }

    $files = array();
    listdiraux($dir, $files);

    return $files;
}

function listdiraux($dir, &$files) {
    $handle = opendir($dir);
    while (($file = readdir($handle)) !== false) {
        if ($file == '.' || $file == '..') {
            continue;
        }
        $filepath = $dir == '.' ? $file : $dir . '/' . $file;
        if (is_link($filepath))
            continue;
        if (is_file($filepath))
            $files[] = $filepath;
        else if (is_dir($filepath))
            listdiraux($filepath, $files);
    }
    closedir($handle);
}

function file_extension($filename)
{
   $info = pathinfo($filename);
   return $info['extension'];
} 
?>

When I try to run this via a cron, I get the output "You must enter a valid path such as /home/apresv/public_html or apresv/public_html for this script to function.

What do I need to do to get this to run via a CRON JOB?

Thanks!

  • 1
    Does it run from the command-line? What is your crontab line? – mivk Feb 13 '16 at 23:40
  • You need to give a parameter with the path which files should be backuped. you can see this in line 3. – Broatcast Feb 13 '16 at 23:48
  • What would that look like? This is a standard webhosting directory path environment... The cron line looks like this currently '0 0 * * * /usr/bin/php /home/apresv/fix_hack.php' – dprestia Feb 14 '16 at 17:29
0

The basic to execute a script with CRON is to make the file executable, talking about a php file you must give the file the path where is the interpreter command, this is called shebang (read more about in here) and must be placed at the very top of the script.

So you must do the following

$ chmod +x script.php
$ sed -i '1 i\#!/usr/bin/php' script.php #This is to insert the shebang

So you can configure the CRON

$ crontab -e
* * * * * /path/to/script.php

NOTE: Of course you have to be sure your script works.

  • What would that look like? This is a standard webhosting directory path environment... The cron line looks like this currently '0 0 * * * /usr/bin/php /home/apresv/fix_hack.php' – – dprestia Feb 18 '16 at 14:55
  • @dprestia Ok, that means that you want to execute your script every day at 00:00:00 hour right? ddi you execute crontab -e to configure or how did you insert that line? – tachomi Feb 18 '16 at 14:58
  • Webhost Crontab Tool... The timing at this point isn't the issue - its getting the script past the "you must enter a valid path...." message – dprestia Feb 18 '16 at 15:12
  • @dprestia Do you have access to the command-line of the server? Execute $ crontab -e and remove the /usr/bin/php path from the cron so it looks like 0 0 * * * /home/apresv/fix_hack.php – tachomi Feb 18 '16 at 15:16
  • i do thru the cron tab tool - i removed the /usr/bin/php as suggested... i now get the following response ..."/bin/sh: /home/apresv/fix_hack.php: usr/bin/env: bad interpreter: No such file or directory" – dprestia Feb 18 '16 at 16:01
0

You need to do one of two things:

  1. Add a "shebang" line to your script. The first line should read: #!usr/bin/env php In this case ensure that your PHP script is marked executable.

  2. Have cron call the PHP interpreter with your script as the argument. In this case, the crontab entry would be: * * * * * /usr/bin/php /path/to/script.php

You need to take all the usual precautions about cron jobs: they don't have much in PATH enviornment variable. They don't have your .profile (or whatever) sourced, so environment variables your shell usually has, aren't there. The process started by crond probably has / as its current working directory.

  • What would that look like? This is a standard webhosting directory path environment... The cron line looks like this currently '0 0 * * * /usr/bin/php /home/apresv/fix_hack.php' – – dprestia Feb 18 '16 at 14:55
  • @dprestia - you've done my option (2). That much looks good. PATH probably has /bin:/usr/bin and that's all. Since your PHP code uses $argv[1], you will have to change the crontab entry to contain that extra command line parameter: /usr/bin/php /home/apresv/fix_hack.php /whatever/directory/subdirectory, with the desired directory name instead of the fake path. – Bruce Ediger Feb 18 '16 at 17:14
  • Line 7 states 'if (!is_dir($argv[1]))' Somewhere here the path needs to be defined before it gets to the echo statement... Can you see in the CODE where to define the path to satisfy this argument? – dprestia Feb 18 '16 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.