0

I need to run a command to grep one of these strings from command line as web host disabled account to run website from browser until virus files are removed and I managed to collect few strings that can find those files.

I would appreciate if someone knows if I can run a command for this.

Text to find:

bigdeal777
Goog1e_analist_certs.*
tevq\(ucyq\)
GR_HOST_ID.*
\['cmd'\]
ejppy.*
eval\(gzinflate.*
eval\(base64_decode.*
FilesMan.*
Web Shell by.*
Goog1e_analist_up.*
palcastle.*
shell_exec
google_analytics_obh.*
udb=1
createCSS.*
base64_decode\(str_replace
exit;move_uploaded_file
msgz.*
iskandar.*
\.sterling.*
CLaW.*
feoMEN.*
Hacke.*
into [a-z0-9\-_]{1,}orders
gagal
JSinj
linkonline
SUKS.*
\@system\(
\@passthru\(
\@popen\(
Mohajer22
\@extract\(
likecinema
mp3aim
mixmenow
lyricsoasis
PGlmcmFtZSBzcmM9Imh0dHA6Ly93d3cubC1jb3VudGVyLmNvbS9zdGF0cy5waHA\/aWQ9
\$_POST\[\'skip\'\]
u0058
urlencode\(strrev
viagra.*

I just need to know full path to the matching file.

Thank You.

Improve this question

2 Answers 2

Reset to default
1

If you can put those in a file you can use grep's -f flag to read the patterns from a file and you can use -l to show just the files that have a match

Putting those together you can do something like

grep -R -l -f scanner.txt *

So the -R will cause it to search recursively (I'm assuming you want that), -l will print just the names of the files that contain a match, and -f says to read the search patterns from the file scanner.txt

Improve this answer
5
  • what will command look like if string filename is scanner.txt. thanks. Commented Apr 30, 2015 at 1:19
  • Edited to reflect a command to try Commented Apr 30, 2015 at 1:21
  • updated string above that i am using now. and i got this error: grep: Unmatched ( or \(. Can you please try and let me know if you see same error or works for you. Thanks. Commented Apr 30, 2015 at 1:29
  • It's trying to interpret the patterns as regex, but you could also add -F to tell it not to (though you may want to get rid of a lot of the .* and similar in those patterns then) Remember that it will already match anything on the line, so don't need to tell it to match "whatever comes after it" you get that for free Commented Apr 30, 2015 at 1:39
  • 1
    Thanks. grep -R -l -F -f ../scanner.txt * did the trick :) Commented Apr 30, 2015 at 1:45
1

I think it can helps you :

#!/bin/bash
declare arr=('bigdeal777',
    'Goog1e_analist_certs.*',
    'tevq\(ucyq\)',
    'GR_HOST_ID.*',
    "\['cmd'\]",
    'ejppy.*',
    'eval\(gzinflate.*',
    'eval\(base64_decode*.',
    'FilesMan*.',
    'Web Shell by.*',
    'Goog1e_analist_up.*',
    'palcastle.*',
    'shell_exec',
    'google_analytics_obh.*',
    '"udb=1"',
    'createCSS.*',
    'base64_decode\(str_replace',
    'exit;move_uploaded_file',
    'msgz.*',
    'iskandar.*',
    '\.sterling.*',
    'CLaW.*',
    'feoMEN.*',
    'Hacke.*',
    'into [a-z0-9\-_]{1,}orders',
    'gagal',
    'JSinj',
    'linkonline',
    'SUKS.*',
    '\@system\(',
    '\@passthru\(',
    '\@popen\(',
    'Mohajer22',
    '\@extract\(',
    'likecinema',
    'mp3aim',
    'mixmenow',
    'lyricsoasis',
    'PGlmcmFtZSBzcmM9Imh0dHA6Ly93d3cubC1jb3VudGVyLmNvbS9zdGF0cy5waHA\/aWQ9',
    "\$_POST\[\'skip\'\]",
    'u0058',
    'urlencode\(strrev',
    'viagra.*');
arr_size=${#arr[@]};
for i in `seq 1 $arr_size` ; do 
    echo ${arr[$i]}|egrep -i "$1" ;
done;

Usage :

./script.sh eval
Improve this answer
5
  • sh script.sh prints those string and ./script.sh eval i get permission denied message. Commented Apr 30, 2015 at 2:06
  • chmod +x script.sh Commented Apr 30, 2015 at 19:56
  • Thx. Now I am getting this: eval\(gzinflate.*, eval\(base64_decode*., Commented May 1, 2015 at 0:19
  • Now, you can up vote... Commented May 1, 2015 at 0:49
  • Sorry, I don't have enough score to vote up. But with the issue, it's not finding files with those strings though. I added one file with strings, but it can't find that. I think, the script fails at eval line? Commented May 1, 2015 at 1:57

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.