1

I'd like to search for suspicious php-files on a linux machine. Currently I have a solution for large strings, but few days ago I found a new version of a suspicious script. Instead of just setting a variable in one long line, the new version splits the line into chunks and concat it.

Here is a sample:

    $dlujpdi = 
    'KXskXXxbZSgnb2R5cmltcHViTkVDIHBvbWVvLCR0clRoPmRvc2V7TWVzJGZpb25zRV9'.
    'MICRsbWUoaXMtbmV3Y2Uoan07cGVucy0+dD0kY291KCdtZWxkcnJwaGlzJy4nZighLC'.
    'RwdGVkLT5TZXcgaWYobVsxdGhpKCRwZGRybiBmJHBhbiAkdGhpJHRobmQpQ2hhJGFkZ'.
    'XQsdGVkZCgnKXtyZXI9fXxcdXJudGlvbmU7b2RlaGVsaXZlOV17ZWRDLicodHIob24g'.
    'YnJldHRhb21IY3RpdGlvcy0+cy0+TVRQKCRkW109KTt9JHN0ZHkudGhpaGFybWF0J0N'.
    'vJyAnYWluJGJvc19rXC9cJG1zYm9kdGh0PnZhbiI7UyopJHN0bGVyJyc7cycpYSl7Py'.
    '8iaXMtbWUpLT5zKHN0KD8hOkRFcy0+cmV0QWx0c3MiYW1laWYoKS0kaGlzSCcsJGJvK'.
    'DIsNzdcc3RyLjIzJycsX2Nvcy0+ZXNwPmFkc2FnezY1OjpEPnRlb2R5bWF4aW1lcHVi'.

and so on. That why I'd like to search for this pattern, where Base64 Parts are concat together with a dot like here. Is there a way to do it with Linux Tools without writing a new short program?

6
  • Please add your desired output for that sample input to your question.
    – Cyrus
    Jan 19, 2018 at 20:25
  • I'd like to get a list of files in a directory that are having this kind of pattern, where the script is building a long base64 string
    – user39063
    Jan 19, 2018 at 20:27
  • 2
    Rather than looking for Base64-encoded strings, look for the tools that use them. You'll need at least one instance hidden somewhere of base64_decode() being invoked, and you can backtrace from there.
    – DopeGhoti
    Jan 19, 2018 at 20:32
  • if I'm looking for base64_decode() I get too many false positives, because it's valid to use this function.
    – user39063
    Jan 19, 2018 at 20:40
  • 1
    I would also try to fix/attack the underlying cases of why they do appear. Jan 19, 2018 at 21:05

1 Answer 1

2

On a Linux system, you could use something like:

grep -Erl '[[:alnum:]/+]{20,}' /path/to/php/parent/directory/*

Which tells grep to recursively look for files that contain at least 20 sequential characters from the Base64 alphabet; matching files have their filename printed. Adjust the 20 to taste.

2
  • I had almost the same idea: grep -Elir "'[+0-9a-z]{67}'\." *
    – Cyrus
    Jan 19, 2018 at 20:45
  • I debated about anchoring the line, but opted for something slightly more general, in case the next hiding technique uses different quoting or line lengths. Does require some tuning on the OP’s part to separate wheat from chaff.
    – Jeff Schaller
    Jan 19, 2018 at 20:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .