how to use sed command to replace everything before second occurrence?

Question

My sites got infected with some bad malware that has inserted malicious code on at least 3135 files (all my wordpress sites).

This is one of the files infected: http://pastebin.com/FXU1ht4R

And here is my desired output: http://pastebin.com/YPJwjiWH

I have no idea about Unix commands, besides some simple find and grep commands.

After some research I found about the sed command but I don't know how to use it in my case.

As you can see from the above code, the general pattern is that the code is inserted at the top of each file, meaning before the original <?php tag (which means now the original <?php tag is second.

So I thought I could find all the files containing cnajwp = and remove everything before the second <?php tag.

I can find the files containing cnajwp by using

find * -type f -name "*.php" -exec grep -l "cnajwp =" {} \;

but I don't know how to replace everything before the second <?php tag on these occurrences.

Could anybody here give me a helping hand?

Answer 1

This uses your command to find the infected files, and gives the list to xargs, which runs an expression on the first line.

find * -type f -name "*.php" -exec grep -l "cnajwp =" {} \; |
xargs sed -i -E '1s/^(<\?php) \$ocnajwp =.*$/\1/'

According to your input-file sample, this should do the trick.

Since in the meantime you have found files, where the infection was placed slight differently, and you have ended up with some files, where both first lines contain <?php, you could run the following to clean up those files:

find * -type f -name "*.php" -exec \
gawk -i inplace 'NR==2 && /^<\?php$/ {next} 1' {} \;

Answer 2

This solution accommodates a case where the malicious script spans more than one line and will use the in-place edit to change the files directly on the server.

find /base/path/here -type f -name "*.php" -exec \
sed -Ei '/<\?php/{:l1;/.*\?><\?php/!{N;bl1};s/<\?php.*\?>(<\?php)/\1/}' {} \;

Hope this fits the requirement.

Answer 3

From what I could see, all the malicious code you want to delete is put in line 1. But be aware that your <?php tag is put in that line either, so you should change the whole first line to <?php instead of deleting it.

All you need is to use the command below:

sed -i '1 s/^.*$/<?php/g' yourFile.php

-i option will change the file in-place.

So for your find command you've used:

find * -type f -name "*.php" -exec sed -i '1 s/^.*$/<?php/g' {} \;

For files that contain two <?php tags on both first and second lines, you need to run the command below, after running the above find command:

find * -type f -name "*.php" -exec perl -ni -e 'print if $. < 1 or $. > 3 or !$seen{$_}++' {} \;

So it will delete duplicate lines met from line 1, to line 3. -i option will change the file in-place.