0

Here is the script:


<?php
//Create back files?
define('CREATE_BACKUPS', FALSE);

if (!is_dir($argv[1]))
{
   echo "You must enter a valid path such as /home/apresv/public_html or apresv/public_html for this script to function.\n";
   exit;
}

//Search the path for all php files, opening each one, and checking to see if it's infected

//First, get an array list of all valid .php files.


$files = listdir($argv[1]);
foreach ($files as $filename)
{
   //We only need to check php files, so we add that here
   if (file_extension($filename) == 'php')
   {
      //This is a php file so lets check it to see if it's infected.
      $contents = file_get_contents($filename);
      $backup = $contents;

      //There will always be 2 opening tags in an infected file and since the hack is always at the top, it's easiest to test for this right away.
      $test = between('<?php', '<?php', $contents);

      //This particular hack likes to use toolbarqueries so we test to see if our chunk is an infected chunk.  If your website uses this url somehow, then add extra if statements as necessary.
      if (after('toolbarqueries', $test))
      {
         //This chunk is infected.  So lets replace it and resave the file.
         $contents = str_replace('<?php'.$test.'<?php', '<?php', $contents);

         //Now save it! Woohoo!
         file_put_contents($filename, $contents);
         if (CREATE_BACKUPS)
         {
            file_put_contents($filename.'.orig', $backup);
         }

         echo "$filename has been cleaned.\n";
      }
   }
}

function after ($this, $inthat)
    {
        if (!is_bool(strpos($inthat, $this)))
        return substr($inthat, strpos($inthat,$this)+strlen($this));
    };

    function after_last ($this, $inthat)
    {
        if (!is_bool(strrevpos($inthat, $this)))
        return substr($inthat, strrevpos($inthat, $this)+strlen($this));
    };

    function before ($this, $inthat)
    {
        return substr($inthat, 0, strpos($inthat, $this));
    };

    function before_last ($this, $inthat)
    {
        return substr($inthat, 0, strrevpos($inthat, $this));
    };

    function between ($this, $that, $inthat)
    {
     return before($that, after($this, $inthat));
    };

    function between_last ($this, $that, $inthat)
    {
     return after_last($this, before_last($that, $inthat));
    };

    // USES
    function strrevpos($instr, $needle)
    {
        $rev_pos = strpos (strrev($instr), strrev($needle));
        if ($rev_pos===false) return false;
        else return strlen($instr) - $rev_pos - strlen($needle);
    };

    function listdir($dir='.') {
    if (!is_dir($dir)) {
        return false;
    }

    $files = array();
    listdiraux($dir, $files);

    return $files;
}

function listdiraux($dir, &$files) {
    $handle = opendir($dir);
    while (($file = readdir($handle)) !== false) {
        if ($file == '.' || $file == '..') {
            continue;
        }
        $filepath = $dir == '.' ? $file : $dir . '/' . $file;
        if (is_link($filepath))
            continue;
        if (is_file($filepath))
            $files[] = $filepath;
        else if (is_dir($filepath))
            listdiraux($filepath, $files);
    }
    closedir($handle);
}

function file_extension($filename)
{
   $info = pathinfo($filename);
   return $info['extension'];
} 
?>

When I try to run this via a cron, I get the output "You must enter a valid path such as /home/apresv/public_html or apresv/public_html for this script to function.

What do I need to do to get this to run via a CRON JOB?

Thanks!

3
  • 1
    Does it run from the command-line? What is your crontab line?
    – mivk
    Feb 13, 2016 at 23:40
  • You need to give a parameter with the path which files should be backuped. you can see this in line 3.
    – Broatcast
    Feb 13, 2016 at 23:48
  • What would that look like? This is a standard webhosting directory path environment... The cron line looks like this currently '0 0 * * * /usr/bin/php /home/apresv/fix_hack.php'
    – dprestia
    Feb 14, 2016 at 17:29

1 Answer 1

0

The basic to execute a script with CRON is to make the file executable, talking about a php file you must give the file the path where is the interpreter command, this is called shebang (read more about in here) and must be placed at the very top of the script.

So you must do the following

$ chmod +x script.php
$ sed -i '1 i\#!/usr/bin/php' script.php #This is to insert the shebang

So you can configure the CRON

$ crontab -e
* * * * * /path/to/script.php

NOTE: Of course you have to be sure your script works.

9
  • What would that look like? This is a standard webhosting directory path environment... The cron line looks like this currently '0 0 * * * /usr/bin/php /home/apresv/fix_hack.php' –
    – dprestia
    Feb 18, 2016 at 14:55
  • @dprestia Ok, that means that you want to execute your script every day at 00:00:00 hour right? ddi you execute crontab -e to configure or how did you insert that line?
    – tachomi
    Feb 18, 2016 at 14:58
  • Webhost Crontab Tool... The timing at this point isn't the issue - its getting the script past the "you must enter a valid path...." message
    – dprestia
    Feb 18, 2016 at 15:12
  • @dprestia Do you have access to the command-line of the server? Execute $ crontab -e and remove the /usr/bin/php path from the cron so it looks like 0 0 * * * /home/apresv/fix_hack.php
    – tachomi
    Feb 18, 2016 at 15:16
  • i do thru the cron tab tool - i removed the /usr/bin/php as suggested... i now get the following response ..."/bin/sh: /home/apresv/fix_hack.php: usr/bin/env: bad interpreter: No such file or directory"
    – dprestia
    Feb 18, 2016 at 16:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .