How can I remove a malicious line of code and replace it with the opening php tag using regex, in multiple files?

Question

I use a domain in my server for dev websites, I have put them all as subdomains in the same domain, like client1.mydomain.com, client2.mydomain.com, and so on. Well, all of these websites were targeted by a malicious code, it seems it's always the very first line in the files - all the files in the sites it seems.

I'm looking for a way of removing this malicious line of code, but replace it with the opening php tag - or anything that will only remove the malicious code and not my opening php tag where it exists.

Here's what the malicious line looks like:

<?php $vhilmjpo = 'x53 105 x53 137 ........ (it goes like this with random strings and numbers for a long while) .... (and it finishes with the ending php tag) ... ?>

The problem is that sometimes my files start with the php opening tag and sometimes it's plain html, so I can't just remove the complete line and replace with <?php

So, sometimes, the files start like this:

<?php $vhilmjpo = 'x53 .......?><?php

and sometimes it's like this:

<?php $vhilmjpo = 'x53 .......?><div class="whatever">

I have used sed in the past, and it proves to be of great help, but I don't know how to do it for this particular case.

Something like this could work if all of my files had the malicious line on a line of its own, but that's not the case:

sed -i '/vhilmjpo/d'

Any idea of how to do this? I was thinking probably a regex to match only between the php tags, something like <?php $vhilmjpo[.+?]\?>, and replace all of that with an empty string.

Don't use your sed command. It will remove the malicious code + the eventual html that is on the same line. — Casimir et Hippolyte, Apr 21 '17 at 19:07
I know, but how to do it then? sed is supposed to also replace only substrings on a line, but I need it to use a regex to find the substring to replace — andrux, Apr 21 '17 at 19:11
This might help: [Website hacked, how to remove malicious code with SED / GREP](http://stackoverflow.com/q/28317990/3776858) — Cyrus, Apr 21 '17 at 19:19
@Cyrus I can only restore the core files, but not all my custom work — andrux, Apr 21 '17 at 19:28

Casimir et Hippolyte · Accepted Answer · 2017-04-21T19:33:08.327

1

You can try this one:

sed '1{s/<?php \$vhilmjpo\([^?]\|??*[^?>]\)*?>//}' file

and if it works as expected then add the -i switch.

details:

1   # if the first line is processed then: 
{
    s/<?php \$vhilmjpo\([^?]\|??*[^?>]\)*?>// # replace from the opening tag followed
                                # by "$vhilmjpo" until the next closing tag
}

edited Apr 21 '17 at 19:33

answered Apr 21 '17 at 19:12

Casimir et Hippolyte

88,009
5
94
125

it didn't work :( can you explain what that command does? I understand the regex - sort of - but not the rest – andrux Apr 21 '17 at 19:16
`[^?]*` means "anything but the question mark zero or more times"? – andrux Apr 21 '17 at 19:19
@andrux: yes, exactly. I think it should suffice but it's also possible to be more explicit. – Casimir et Hippolyte Apr 21 '17 at 19:20
I also just tried this: `sed '{s/<\?php \$vhilmjpo[^?]*\?>//}' file.php` but it still didn't work – andrux Apr 21 '17 at 19:21
@andrux: you don't have to escape the question mark in BRE, it's a literal character. I tested the command and it works well. Eventually replace the space in the pattern by ` *` (two spaces and the quantifier `*`) – Casimir et Hippolyte Apr 21 '17 at 19:23
could you try it with the real thing? I copied the file contents into this gist: https://gist.github.com/andruxnet/b4bf4148374f65d3b3e9bb3e07e7e285 – andrux Apr 21 '17 at 19:26
@andrux: ok I take a look. – Casimir et Hippolyte Apr 21 '17 at 19:27
@andrux: there are other question marks that are not part of the closing tag. I edited my pattern to take it in account. – Casimir et Hippolyte Apr 21 '17 at 19:34
That last one worked! How can I do it for all files in the directory? just remove the file name? – andrux Apr 21 '17 at 19:37
I did it like this with the find command: `find . -name '*.php' | xargs sed -i '1{s/]\)*?>//}'` thanks!! – andrux Apr 21 '17 at 19:52
1

@andrux: you can shorten the sed command like this: `sed '1s/]\)*??*>//'` – Casimir et Hippolyte Apr 21 '17 at 19:55

How can I remove a malicious line of code and replace it with the opening php tag using regex, in multiple files?

1 Answers1