Someone put a lot of malicious code onto every single wordpress instance on my server. For the second time. (At least) Every js file has been modified. There is a pattern though, the code always looks like this:

/*[file-name]*/[malicious code]/*file-name*/

is there any way that I could use grep and sed to get rid of those fragments? A previous attack put similar code in the files, which I got rid of using

grep -rnwl './' -e "[/*]d754948f7cc08347e64716505bd652ae[*/].*[/*]d754948f7cc08347e64716505bd652ae[*/]" | xargs sed -i "s/[/*]d754948f7cc08347e64716505bd652ae[*/].*[/*]d754948f7cc08347e64716505bd652ae[*/]//g"

is there any way to modify this exprssion to use each file name instead of a fixed string like "d754948f7cc08347e64716505bd652ae"?

  • 7
    If someone has placed malicious code freely you are best off re-grooming your server from a clean backup. The attacker very possibly left themselves a backdoor to get in (especially considering this is the second time). Restoring a back up of the server and addressing your security is the best method to combat successful attacks. – Centimane Mar 4 '16 at 13:35
  • The problem is, that the last backup that I would deem clean is too old and all the newer ones are probably already infected. The first attack happened a long time ago, but somehow we missed it for quite a while. So I will have to rebuild a LOT of stuff, but until then it would be nice to at least remove the symptoms for a while. – Marvin Pollock Mar 4 '16 at 13:46
  • 1
    @MarvinPollock This is also why I recommend kickstart files rather than using clones for servers. Having your server configuration generated by your kickstart file/scripts means you don't have to worry about your backup server config being dirty. – Centimane Mar 4 '16 at 14:18
  • @Dave Well, I probably should have mentioned, that it's a hosted and shared server, so I don't really have direct access to the server config itself. The attack seems to be exclusive to my websites though, since the server itself and as far as we can tell all the other websites on it are not infected. Well, time to get a proper one and start from scratch, I guess. – Marvin Pollock Mar 4 '16 at 16:55
  • 1
    That's useless. If you just revert the visible malicious code, then 1. that leaves all the malicious code that you didn't find; and 2. that leaves the security hole in place so the malware is likely to come back. You must revert from a clean backup and you must find how the attacker got in and plug the hole. – Gilles Mar 4 '16 at 20:59

I create final code incrementally, first we find all js files:

find <project_dir> -type f -name '*.js'

Then we iterate these files:

find <project_dir> -type f -name '*.js' | while read file_path; do
    # Code here run once for every file

Then we create a pattern by using the file name, and use sed to get rid of malicious code in file:

find <project_dir> -type f -name '*.js' | while read file_path; do
    file_name=$(basename "$file_path")
    sed -ri "s:$pattern::g" "$file_path"

Some notes:

  • Step zero is backing up your files.
  • In sed command I used "s:$pattern::g" instead of "s/$pattern//g", because our search pattern already have '/' in it, and that makes sed confused.
  • This code handle file name containing space, at least I tried to handle it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.