3

currently I have a problem with a server. One user who is hosting a lot of sites got hacked and some of his php files were modified. Now I want to get a list of the infected files and also want to check if he cleaned the whole mess.

The common thing between the infected files is that the first line is very long. So I'd like to find every php file on the server that has a min length of 1000 chars.

Well, I can find all php files with "find" and get with "head -n 1" the first line and count the chars with "wc -m".

But how can I combine it together?

Improve this question
2
  • 8
    Doesn't answer your question, but truthfully, you should nuke it from orbit and restore from backup. (You have backups, of course?)
    – Wildcard
    Commented May 5, 2016 at 6:41
  • I have backups, I don't think, the owner of the sites have any ;) But I also want some kind of a script, that is able to detect the infections.
    – user39063
    Commented May 5, 2016 at 8:09

2 Answers 2

Reset to default
7

You can do it with just find and awk:

find . -type f -name '*.php' -size +1000c -exec awk '
    FNR > 1 {nextfile}
    length >= 1000 {print FILENAME}' {} +

The awk script skips to next file after the first line of every file. It prints the filename of the current file if the current line is >= 1000 characters long.

Improve this answer
2
  • Or length >= 1000. Note that nextfile is in a few other awk implementations as well, you can add a -size +1000c to avoid the check on small files.
    – Stéphane Chazelas
    Commented May 5, 2016 at 6:50
  • 1
    yep, just figured that out myself while testing with original-awk and mawk. nextfile isn't much of a portability problem, the problem was the regexp with {1000,} the -size is a useful improvement.
    – cas
    Commented May 5, 2016 at 6:51
1

You can try this one using find and grep :

find . -type f -name '*.php' -exec grep '.\{1000\}' {} +
Improve this answer
2
  • that will check every line of each file, not just the first line of each.
    – cas
    Commented May 5, 2016 at 7:00
  • @cas yes, you are right. In that case your answer is much more better than mine. +1 for yours.
    – Rahul
    Commented May 5, 2016 at 7:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .