SED Usage to delete an injection
 

Trying to delete injected code (one line) into multiple .php and .html files of a server with sed command but it seems there is a problem with sed when " and / are included in the string to be deleted.

The string that needs to be deleted is
<img heigth="1" width="1" border="0" src="http://imgddd.net/t.php?id=16382836">

However the last part of the string (id=########) is not constant (the number is variable) so I used the following:

find /home -type f -iname \index.html\* -o -iname \index.php\* -o -iname \index.html\* -o -iname \index*\*| while read FILE; do sed -i "s|<img heigth="1" width="1" border="0" src="http:\\imgddd.net*">||g" "${FILE}"; done

For some reason it successfuly deleted the injection on .html files but NOT in .php files

Any suggestions?

You are using a shell style wild cards: "net*
To match any character use: .*
The dot matches any character. The * substitutes for any number of the preceding pattern, including zero.
The backslash needs to be escaped, since it is the metacharacter used to escape characters. This means using \\ for each \.

You might want to use: [^"]*
This matches any number of characters which aren't the " character.

Also look at [[:digit:]] or [0-9] to match digits.
[[:digit:]]* for zero or more digits
[[:digit:]][[:digit:]]* for one or more digits.
You can use the option for extended regex expressions and use
[[:digit:]]+ for one or more digits.

Hoever in this particular case:
s|<img[^>]*src=http:\\\\imgddd\.net[^>]*>||g should be enough to contain the entire pattern and prevent false positives if http:\\imgddd.net is unique to the lines you want to remove.

---
Also, if the filenames might contain white space one technique is to use -print0 in find, and | xargs -0 <command> to process the files. Another method is to pipe the output of a list through "tr '\n' '\0'" between find (or cat filelist) and xargs. This is to prevent the "while read FILE" line from reading a filename as two or more arguments.

Hi,

in your example string you are using
http://

but in your sed-statement you are using backslashes. Is this a typo?

To avoid the double-quote issue you can enclose your sed-statement in single-quotes. Since no variables need to be expanded this should be ok.

[EDIT]
Can you give some examples how the files are named you are searching for? I see backslashes in your find command; some of them might be falsely interpreted as escape sequence and therefore you miss some files.

Thanks for your reply,
Yes it is a typo http:// is the one that used in the sed command allready without success.
The injection is found in index.html and index.php files in user accounts.

Thanks for your reply
By mistake I used backslashes and not slashes in this post while the string used in the sed was http://imgddd.net and not http:\\imgddd.net without success.
Does the slash needs to be escaped also?

Yes the http://imgddd.net is unique to all injections so using s|<img[^>]*src=http:\\\\imgddd\.net[^>]*>||g (with the appropriate corrections for slashes and not backslashes) will delete the line?

As I mentioned earlier, your find command is probably flawed. Try this
I assume that you only want to change files that are either named index.html or index.php.

If you used forward slashes as a separator in the sed commands, you would need to escape the slashes in the expressions; however you used `|' instead to avoid that problem. So in this example you don't need to escape forward slashes.

Using sed, it can be a trick to identify what the matching patterns will be that won't produce false positives. Sometimes you need 2 or more commands to cover border cases as well.

Good Luck.

The following worked finally
Thank you both for your valuable assistance

Hello guys,

those who are facing problem with that virus, pls check their hosting account for some malicious files specifically 2 php files with some different names. it contains code like this :
Also try to check .htaccess file which will be like this :
It is very possible that there will be some different php file name instead of pets.php. so remove all those messy stuff from your hosting and you will good to go from there.

Thanks,
Dev