what is wrong with my shell script ???

HuMan-BiEnG · 06-13-2010, 08:34 AM

Hello ,

i'm making a new second shell script called shell scanner

for detecting encoded shells ,

the script depends on a list of file names

that i want to execlude from the output of the script ,

but i found that the excluded file names appears in the output

here is my script (sorry for my poor shell scripting knowledge) :

#!/bin/bash

echo "ShellScan is started ..!"
find /home/*/public_html -name "*.php" -exec egrep -ri -l "@Zend|ionCube Loader|base64_decode" {} \; >> detected.txt
cat detected.txt | sed "s/.*\///" >> tocompare.txt
echo "Shell Scan will give you the report, please wait"

for i in `cat tocompare.txt`
do

if [$i = functions.php]
then
sed -i 1d detected.txt
elif [$i = attachment.php]
then
sed -i 1d detected.txt
elif [$i = cron.php]
then
sed -i 1d detected.txt
elif [$i = ads.php]
then
sed -i 1d detected.txt
elif [$i = gifimg.php]
then
sed -i 1d detected.txt
elif [$i = browse.php]
then
sed -i 1d detected.txt
elif [$i = config.php]
then
sed -i 1d detected.txt
elif [$i = wp-app.php]
then
sed -i 1d detected.txt
elif [$i = class-simplepie.php]
then
sed -i 1d detected.txt
elif [$i = class-IXR.php]
then
sed -i 1d detected.txt
elif [$i = gysn-kg.php]
then
sed -i 1d detected.txt
elif [$i = xmlrpc.php]
then
sed -i 1d detected.txt
elif [$i = ticketfunctions.php]
then
sed -i 1d detected.txt
elif [$i = pipefunctions.php]
then
sed -i 1d detected.txt
elif [$i = pipe.php]
then
sed -i 1d detected.txt
elif [$i = protxvspform.php]
then
sed -i 1d detected.txt
elif [$i = googleresponse.php]
then
sed -i 1d detected.txt
elif [$i = index.php]
then
sed -i 1d detected.txt
elif [$i = thumb.php]
then
sed -i 1d detected.txt
else
echo "Suspeciuos file detected :"
echo `head -n 1 detected.txt`
echo "Please check it urgently"
head -n 1 detected.txt >> found.txt
sed -i 1d detected.txt

fi

done

after this script is run ,

i found that the file names that i want to exclude (ex, index.php)

appears in the found.txt ,

please could anyone help me in this problem ,

thanks alot for everyone,

smoker · 06-13-2010, 09:53 AM

Try putting the comparisons in quotes.
i.e.

Code:

elif ["$i" = "index.php"]

http://tldp.org/LDP/abs/html/comparison-ops.html

pixellany · 06-13-2010, 09:59 AM

Moved to Programming

HuMan-BiEnG · 06-13-2010, 11:07 AM

Hello ,

smoker , yeah i treid quoting ,

but also it doesnt work with me

HuMan-BiEnG · 06-13-2010, 11:10 AM

hello ,

smoker , i tried qouting ,but i was using one equal sign "=" not two "=="

so i will give it a try ,

thanks man for the link ,

PTrenholme · 06-13-2010, 12:00 PM

You migh try a simpler form:

Code:

#!/bin/bash
echo "ShellScan is started ..!"
cat <<EOF > ignore
functions.php
attachment.php
cron.php
ads.php
gifimg.php
browse.php
config.php
wp-app.php
class-simplepie.php
class-IXR.php
gysn-kg.php
xmlrpc.php
ticketfunctions.php
pipefunctions.php
pipe.php
protxvspform.php
googleresponse.php
index.php
thumb.php
EOF
find /home/*/public_html -name "*.php" -exec egrep -ri -l "@Zend|ionCube Loader|base64_decode" {} \; > detected
[ -s detected ] || { echo No suspicious files were detected.;rm -f ignore;exit 0 }
echo "Shell Scan will give you the report. Please wait . . ."
grep -vf ignore detected > found.txt
if [ -s found.txt ]
then
  echo "No suspicious files detected."
  rm -f found.txt
else
  echo "The following files are suspect:"
  cat found.txt
  echo "Please check any listed files."
fi
rm -f ignore detected

Warning: Untested code!

HuMan-BiEnG · 06-13-2010, 02:16 PM

Hello ,

PTrenholme i still have problems in my script & i'm working & trying it ,

actually ,my knowledge in shell scripting is not good & i dont understand the code you

just sent ,so i couldnt dare to test it on a server (live server with many accounts)

to not remove any files ,& i depened in my script to not remove ,but show suspecious files

which maybe clean & maybe not ,

so as i told you i will try to solve other problems in my small script & also try to

understand yours ,cuz it seems very good to me ,

anyway thanks alot Senior PTrenholme,

accept my best regards ,,,

HuMan-BiEnG · 06-13-2010, 02:26 PM

Hello Senior PTrenholme ,,

this is my script now :

#!/bin/bash

echo "ShellScan is started ..!"
nice -n -20 find /home/*/public_html -name "*.php" -exec egrep -ri -l "@Zend|ionCube Loader|base64_decode" {} \; >> detected.txt
cat detected.txt | sed "s/.*\///" >> tocompare.txt
echo "Shell Scan will give you the report, please wait"

file1="functions.php"
file2="attachment.php"
file3="cron.php"
file4="ads.php"
file5="gifimg.php"
file6="browse.php"
file7="config.php"
file8="wp-app.php"
file9="class-simplepie.php"
file10="class-IXR.php"
file11="gysn-kg.php"
file12="xmlrpc.php"
file13="ticketfunctions.php"
file14="pipefunctions.php"
file15="pipe.php"
file16="protxvspform.php"
file17="googleresponse.php"
file18="index.php"
file19="thumb.php"

for i in `cat tocompare.txt`
do

if [ $i = $file1 ]
then
echo $i equal $file1
sed -i 1d detected.txt
elif [ $i = $file2 ]
then
echo $i equal $file2
sed -i 1d detected.txt
elif [ $i = $file ]
then
sed -i 1d detected.txt
elif [ $i = $file4 ]
then
sed -i 1d detected.txt
elif [ $i = $file5 ]
then
sed -i 1d detected.txt
elif [ $i = $file6 ]
then
sed -i 1d detected.txt
elif [ $i = $file7 ]
then
sed -i 1d detected.txt
elif [ $i = $file8 ]
then
sed -i 1d detected.txt
elif [ $i = $file9 ]
then
sed -i 1d detected.txt
elif [ $i = $file10 ]
then
sed -i 1d detected.txt
elif [ $i = $file11 ]
then
sed -i 1d detected.txt
elif [ $i = $file12 ]
then
sed -i 1d detected.txt
elif [ $i = $file13 ]
then
sed -i 1d detected.txt
elif [ $i = $file14 ]
then
sed -i 1d detected.txt
elif [ $i = $file15 ]
then
sed -i 1d detected.txt
elif [ $i = $file16 ]
then
sed -i 1d detected.txt
elif [ $i = $file17 ]
then
sed -i 1d detected.txt
elif [ $i = $file18 ]
then
sed -i 1d detected.txt
elif [ $i = $file19 ]
then
sed -i 1d detected.txt
else
head -n 1 detected.txt >> found.txt
sed -i 1d detected.txt
fi

done

but when i execute it i found this message

bash: [: too many arguments
bash: [: too many arguments

could you please help me in this Senior PTrenholme ??

grail · 06-13-2010, 10:23 PM

I am curious but it seems you list a long list of names to check that you do want to look at, how long is the list of names you wish to exclude?

If it is less than say 2 or 3 then you could for go all of the individual sed statements and just use find to not return those files.

Just a suggestion.

PTrenholme · 06-14-2010, 06:19 PM

Try this simplification.

Code:

#!/bin/bash

echo "ShellScan is started ..!"
nice -n -20 find /home/*/public_html -name "*.php" -exec egrep -ri -l "@Zend|ionCube Loader|base64_decode" {} \; >> detected.txt
cat detected.txt | sed "s/.*\///" >> tocompare.txt
echo "Shell Scan will give you the report, please wait"

file[1]="functions.php"
file[2]="attachment.php"
file[3]="cron.php"
file[4]="ads.php"
file[5]="gifimg.php"
file[6]="browse.php"
file[7]="config.php"
file[8]="wp-app.php"
file[9]="class-simplepie.php"
file[10]="class-IXR.php"
file[11]="gysn-kg.php"
file[12]="xmlrpc.php"
file[13]="ticketfunctions.php"
file[14]="pipefunctions.php"
file[15]="pipe.php"
file[16]="protxvspform.php"
file[17]="googleresponse.php"
file[18]="index.php"
file[19]="thumb.php"



for i in `cat tocompare.txt`
do
  found=1
  for (j=1;j<20;++j)
  do
    if [ $i = $file[j] ]
    then
      echo $i equal $file[j]
      sed -i 1d detected.txt
      found=0
    fi
    break
  done
  if [ $found -eq 1 ]
  then
    head -n 1 detected.txt >> found.txt
    sed -i 1d detected.txt
    break
  fi
done

Again, be aware that this is untested code.

Note: The code I suggested above only deletes the temporary files created by the program.

HuMan-BiEnG · 06-14-2010, 06:49 PM

hello Senior PTrenholme ,

i'm nowing testing the script,

thanks alot & i will inform you when i finished testing it ,

thanks again Senior PTrenholme ,,

accept my best regards ,,

everToulouse · 06-15-2010, 04:08 AM

couldn't this be enough

Code:

#!/bin/bash

echo "ShellScan is started ..!"

file=({functions,attachment,cron,ads,gifimg,browse,config,wp-app,class-simplepie,class-IXR,\
gysn-kg,xmlrpc,ticketfunctions,pipefunctions,pipe,protxvspform,googleresponse,index,thumb}.php)

find /home/*/public_html -name "*.php" -exec \
   bash -c 'egrep -lir "@Zend|ionCube Loader|base64_decode" $1 | sed "s/.*\///"' _ {} \; > tocompare

echo "Shell Scan will give you the report, please wait"

while read i; do 
   for (( j=0 ; j < ${#file[@]} ; j++ )); do 
      if [ "${file[j]}" = "$i" ]; then
         echo "$i" | tee -a found.txt
      fi
   done
done <tocompare.txt