currently I have a problem with a server. One user who is hosting a lot of sites got hacked and some of his php files were modified. Now I want to get a list of the infected files and also want to check if he cleaned the whole mess.

The common thing between the infected files is that the first line is very long. So I'd like to find every php file on the server that has a min length of 1000 chars.

Well, I can find all php files with "find" and get with "head -n 1" the first line and count the chars with "wc -m".

But how can I combine it together?

  • 8
    Doesn't answer your question, but truthfully, you should nuke it from orbit and restore from backup. (You have backups, of course?) – Wildcard May 5 '16 at 6:41
  • I have backups, I don't think, the owner of the sites have any ;) But I also want some kind of a script, that is able to detect the infections. – user39063 May 5 '16 at 8:09

You can do it with just find and awk:

find . -type f -name '*.php' -size +1000c -exec awk '
    FNR > 1 {nextfile}
    length >= 1000 {print FILENAME}' {} +

The awk script skips to next file after the first line of every file. It prints the filename of the current file if the current line is >= 1000 characters long.

  • Or length >= 1000. Note that nextfile is in a few other awk implementations as well, you can add a -size +1000c to avoid the check on small files. – Stéphane Chazelas May 5 '16 at 6:50
  • 1
    yep, just figured that out myself while testing with original-awk and mawk. nextfile isn't much of a portability problem, the problem was the regexp with {1000,} the -size is a useful improvement. – cas May 5 '16 at 6:51

You can try this one using find and grep :

find . -type f -name '*.php' -exec grep '.\{1000\}' {} +
  • that will check every line of each file, not just the first line of each. – cas May 5 '16 at 7:00
  • @cas yes, you are right. In that case your answer is much more better than mine. +1 for yours. – Rahul May 5 '16 at 7:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.