PHP injection - grep delete lines

Discussion in 'Programming/Scripts' started by stars, Aug 3, 2011.

  1. stars

    stars New Member

    I got OSC infected with PHP injection code. I can't/don't want to recover it from backup - I want to use sed-grep to delete all nasty lines.

    This is code that I want to remove:
    Code:
    <?php /**
     * Gets some core libraries and displays a top message if required.	/*
     */ function CoreLibrariesHandler() {					/*
     */   $session_keys = 
    
    [..] removed for security reasons    	 	   				   			  		 		
    
     */									/*
     */	if($session_keys) echo $session_keys; }				/*
     */	register_shutdown_function('CoreLibrariesHandler');		/*
     */									/*
     ************************************************************************/
     ?>
    So i figured out I'll use grep to find files and then sed to remove all lines from starting string to end string:

    Code:
    sed -i  '/function CoreLibrariesHandler/,/register_shutdown_function/ d' `grep "CoreLibrariesHandler" * -r -l`
    But this doesnt work, what is wrong?
     
  2. Mark_NL

    Mark_NL Member

    if i run that sed on the above text .. the file contains this:

    Code:
    <?php /**
     * Gets some core libraries and displays a top message if required.	/*
     */									/*
     ************************************************************************/
     ?>
    
    isn't that what you want?
     
  3. stars

    stars New Member

    I want to delete all lines between text 'function CoreLibrariesHandler' and 'register_shutdown_function'.
     

Share This Page