0

I've just spotted in .bash_history file lines below:

grep -iHlnr 'filesman' *2> /dev/null
grep -iHlnr 'eval.*base64_decode' *2> /dev/null

From Google I know that is something like 'malware finding command'. May somebody explain what does it exactly do? (Iknow what is grep for, but that syntax isn't clear to me).

2

The commands you posted do nothing useful — they run grep on files whose name ends with 2, and recursively in directories whose name ends with 2. There's a missing space after * (the space after > is permitted but not useful and more confusing than anything):

grep -iHlnr 'filesman' * 2>/dev/null
grep -iHlnr 'eval.*base64_decode' * 2>/dev/null

This searches for files containing filesman, or containing eval followed by base64_decode on the same line, in the current directory and its subdirectories recursively. The search is case-insensitive. Look at the manual of grep for the exact meaning of each option.

Calling that “malware finding” is a gross exaggeration. It's probably looking for PHP malware, but it might return some legitimate files as well and it only finds a few specific malwares.

  • We could also point out that . should be preferable over * to also search in files whose name starts with . in the current directory (and avoid problems with file names starting with -), and that -H and -n are redundant with -l. – Stéphane Chazelas Sep 4 '16 at 4:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.