• Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other Pie Elite all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Jeanne Boyarsky
  • Ron McLeod
  • Paul Clapham
  • Liutauras Vilda
Sheriffs:
  • paul wheaton
  • Rob Spoor
  • Devaka Cooray
Saloon Keepers:
  • Stephan van Hulst
  • Tim Holloway
  • Carey Brown
  • Frits Walraven
  • Tim Moores
Bartenders:
  • Mikalai Zaikin

Recursive code in files .. Need to delete the code only but leave the file intact

 
Greenhorn
Posts: 2
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
I'm a script newbie and need help in deleting malicious code recursively

the code is nested between the following in at least 100 files..
Any way of deleting the code ..


<?#68c8c7#
echo " $

#/68c8c7#?>
 
Saloon Keeper
Posts: 27763
196
Android Eclipse IDE Tomcat Server Redhat Java Linux
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Welcome to the JavaRanch, John!

Yes, there are multiple ways of doing that. One of them is to write a "sed" script that scans down to your opening offender line and deletes until it has matched the closing offender line. You can use the "find" command combined with "xargs" to run sed (and the sed script) for each file of interest.

Perl can also help do stuff like that.
 
John Roberson
Greenhorn
Posts: 2
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
I tried this

find /hsphere/local/home/dennisch/ -name "*.php" -exec sed -i "/<?68c8c7#/,/68c8c7#?>/d" '{}' \;

But it gives me a lot of

sed: couldn't edit /hsphere/local/home/dennisch/components: not a regular file
sed: couldn't edit /hsphere/local/home/dennisch/components/com_mailto: not a regular file

And doesnt delete the code

Any ideas as to what I'm doing wrong?
 
Rancher
Posts: 280
VI Editor C++ Debian
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator

John Roberson wrote:Any ideas as to what I'm doing wrong?


Fortunately, yes. :-)

John Roberson wrote:I tried this
find /hsphere/local/home/dennisch/ -name "*.php" -exec sed -i "/<?68c8c7#/,/68c8c7#?>/d" '{}' \;



The problem is that the shell sees your characters within the "" and the < and > characters are special to the shell (used to redirect input and output respectively). Replace all the "" in your command line with ' and you should be fine.

Personally, I don't like the -i option. I would like to see the results of sed written out to a different file, and maybe have the option of going back to the original version of the file (the version before sed modified it) -- YMMV.

- Anand
 
reply
    Bookmark Topic Watch Topic
  • New Topic