Website hacked, how to remove malicious code with SED / GREP

Question

a website of mine is hacked. In every php file a line of code is added. I wont post the complete code here, but it starts with:

<?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) { $ua=strtolower($_SERVER["\x48\124\x54\120\x5f\125\x53\105\x52\137\x41\107\x45\116\x54"]); if ((! strstr($ua,"\x6d\163\x69\145")) and (! strstr($ua,"\x72\166\x3a\61\x31"))) $GLOBALS["\x61\156\x75\156\x61"]=1; } ?><?php $yudqgxmnlr =

and ends with:

 $gzagexgpdc=substr($yudqgxmnlr,(34129-24016),(83-71)); $gzagexgpdc($xarchajboj, $ukumkvvgai, NULL); $gzagexgpdc=$ukumkvvgai; $gzagexgpdc=(759-638); $yudqgxmnlr=$gzagexgpdc-1; ?>

I've tried finding and replacing with some ssh commands, but it doesnt seem to work. (Read: my lack of ssh knowledge gets in the way).

This is my latest atempt:

sed -i '<?php if(!isset*gzagexgpdc-1; ?>//g’ *.php

Can anyone help me?

possible duplicate of [Removing an injection using regex](http://stackoverflow.com/questions/26013782/removing-an-injection-using-regex) — Kalanidhi, Feb 04 '15 at 09:43
I wouldn't do this remotely. Download all the files, back it up, do a S&R in your editor, then send it back to the remote site. — halfer, Feb 04 '15 at 10:11
Also, find out _how_ it was hacked. If there is a sec hole, it may happen again. — halfer, Feb 04 '15 at 10:12
Possible duplicate of [Best methods to clean up a hacked site with no clean version available?](http://stackoverflow.com/questions/6337976/best-methods-to-clean-up-a-hacked-site-with-no-clean-version-available) — tripleee, Jul 22 '16 at 19:32
Does this answer your question? [Hacked Site - SSH to remove a large body of javascript from 200+ files](https://stackoverflow.com/questions/55407263/hacked-site-ssh-to-remove-a-large-body-of-javascript-from-200-files) — tripleee, Nov 05 '20 at 09:48

score 1 · Answer 1 · answered Sep 29 '15 at 07:45

1

You can try this : https://github.com/daniyalahmadk/RMCI

Just need to put that code in box and hit submit, it will search code from files and remove them all once.

answered Sep 29 '15 at 07:45

daniyalahmad

3,513
8
29
52

Avinash Raj · Answer 2 · 2015-02-04T11:08:03.447

0

You need to add s/ at the start.

sed 's/<?php if(\!isset.*gzagexgpdc-1; ?>//g' *.php

OR

sed -r 's/<\?php if\(!isset.*gzagexgpdc-1; \?>//g' *.php

Add -i parameter to save the changes made.

edited Feb 04 '15 at 11:08

answered Feb 04 '15 at 09:39

Avinash Raj

172,303
28
230
274

Thanks for your answer. I tried it on one subdir and found out these files ended with a different code so i tried: sed -i 's/<\?php if(!isset.*-1; \?>//g' *.php But this didnt work... Am I missing something? – Bram_Boterham Feb 04 '15 at 09:57
did'nt work how (too much removed or not enough like not all lines, or nothing at all ...) ? – NeronLeVelu Feb 04 '15 at 10:06
Nothing removed, but file-timestamp was edited... Didnt get any feedback trough terminal – Bram_Boterham Feb 04 '15 at 10:07
remove the `-i` parameter. `i` saves the changes made to that file. It won't display the output in the terminal. – Avinash Raj Feb 04 '15 at 10:08
What do you mean Avinash Raj? I tried it without the -i but then it just shows all the files content? – Bram_Boterham Feb 04 '15 at 10:42
yep, `-i` will save the changes made. At first without using the `-i` param we need to check the output produced is correct or not. – Avinash Raj Feb 04 '15 at 10:43
When i do this: sed 's/<\?php if(!isset.*-1; \?>//g' *.php it just shows the complete files: not just the part i want to remove. – Bram_Boterham Feb 04 '15 at 11:01
try `sed 's///g' file` or `sed -r 's/<\?php if\(!isset.*gzagexgpdc-1; \?>//g' file` – Avinash Raj Feb 04 '15 at 11:06
first option (sed 's///g’ *.php) shows nothing, second option shows the complete files again. – Bram_Boterham Feb 04 '15 at 11:35
so use the first option with `-i` param. First check the file for the part you want to remove. – Avinash Raj Feb 04 '15 at 11:39
Unfortunately... No luck.. Any other suggestions? – Bram_Boterham Feb 04 '15 at 11:53

score 0 · Answer 3 · answered Nov 27 '15 at 12:58

0

This should work.

find . -name "*.php" -print0 | xargs -0 sed -ri '1s/^<\?php if\(!isset\(\$GLOBALS\[.*-1; \?>//' *.php

answered Nov 27 '15 at 12:58

Madhukarah

89
1
5

Website hacked, how to remove malicious code with SED / GREP

3 Answers3

Linked

Related