Please review script for search in all files

bkeep · #1 (**permalink**) 11-02-2009

I have written a little script to scan users home directories for certain commands located inside a file. The script is setup to include a small help section and allows for passing a username argument to override scanning of all users home directories.

A lot of searching and trial and error has went into this script on my part. I would appreciate it if some of you that actually know what you're doing can take a look at it for me. If you could give me some pointers, ideas, or suggestions I would be grateful.

Code:

#!/bin/bash

# default folder we will scan
DIR=/home

# a list of commands we need to check for
# seperate commands with a pipe |
LOOKFOR='@system|@shell_exec|@include|@shell'

function help {
  # setup small help list
  echo -e "Pass an aurgument via command line or run without args."
  echo -e "   example: ./filescanner.sh -u username\n"
  echo -e "  -u\t pass a username to run against a single account."
  echo -e "  -h\t This help message.\n"
}

function scanDir {
  # check if $1 else scan all user homes
  if [ "$1" ]; then
    # do stuff on single user
    if [ -d "$DIR/$1" ]; then
      list="$DIR/$1"
    else
      echo "User not found in the \$HOME directory"
      exit
    fi
  else
    # scan all home directories where a user account exists
    list=`grep $DIR /etc/passwd | cut -d: -f6`
  fi

  echo "Checking files for $LOOKFOR."
  for i in $list; do
    path="$i/public_html"
    if [ -d "$path" ]; then
      # check if our path is a directory
      echo "Checking $i/public_html/"
      grep -H -E $LOOKFOR $i/public_html/* -R | cut -d: -f1
    else
      echo "No files to check; $path not a directory."
    fi
  done
}

while getopts  "hu:" flag
do
  case $flag in
    u )
      # echo "$flag" $OPTIND $OPTARG
      # read flag and pass to scanDir function
      scanDir $OPTARG
      exit
    ;;
    h )
      # if h call help function
      help
      exit
    ;;
    * )
      echo -e "Invalid option. Please use -h for help.\n"
      exit
    ;;
  esac
done

# no options passed scan all
scanDir

Scrutinizer · #2 (**permalink**) 11-03-2009

Hi Brandon,

I took a look at your script. IMO it is nicely written, but the actual content strikes me as a bit thin to justify a whole script. By and large, the work involved could be accomplished with the following command:

Code:

grep -H -E '@system|@shell_exec|@include|@shell' /home/*/public_html/* -R | cut -d: -f1

bkeep · #3 (**permalink**) 11-03-2009

Yes, the @symbols are part of what is being checked. The current list is just preliminary and is not complete.

To give a little background. I run a small hosting company. One of my clients was running Zen Cart and it was exploited. While I was doing some of the forensic investigation to find out the cause and the damage, I thought a script to search for certain keywords used in the attack scripts could come in handy.

Once I make sure everything is coded the right way I plan on sharing this with other server admins in a similar situation. Which is why the added stuff to allow for checking a single users public_html directory exists.

I started off with a one liner but during testing found some issues. Checking /home/*/public_html has some drawbacks to my particular situation. I am running a Cpanel server and there are a few non-user directories located in the /home/.

Thanks for the feedback.
Brandon

Quote:

IMO it is nicely written,

P.S. Thank You. I have to admit this is a testament to the quality of help available on this site and others like it.

matrixmadhan · #4 (**permalink**) 11-03-2009

Just a small suggestion to that.

Instead of grep and cut - try using awk - one process without any kernel data structure.

bkeep · #5 (**permalink**) 4 Weeks Ago

Thanks for the reply. Regarding "one process without any kernel data structure", can you elaborate on what you said or post a link? I don't understand what you are talking about. I guess I am going a little deeper down the rabbit hole then I have been before.
edit: I Googled it Kernel Data Structures

I have seen a few posts saying cut is faster then awk and awk is more flexible. To be honest, I don't have a clue. The best I could come up with using awk, was only for part of the process. When I tried using awk in a similar fashion to my existing code I was getting directory errors since part of what was being passed was a directory. I did try something on my own using cut to get multiple fields, I couldn't figure out how to do it or if it was possible.

So this is the sample awk code I have.

Code:

grep -n -E $LOOKFOR $i/public_html/* -R | awk -F":" '{print $1, $2, $3}'

Scrutinizer · #6 (**permalink**) 4 Weeks Ago

How about:

Code:

grep -InE $LOOKFOR $i/public_html/* -R |awk -F: 'NR==1{print;next} p!=$1{p=$1;print p}{print "  "$2,$3}'

bkeep · #7 (**permalink**) 4 Weeks Ago

Thanks for the info.

I made a small change.
Broken after pipe to reduce screen scrolling.

Code:

grep -InE $LOOKFOR $i/public_html/* -R |
awk -F: 'NR==1{print $1,"\n" $2,$3; next} p!=$1{p=$1; print p} {print "   " $2,$3}'

More UNIX and Linux Forum Topics You Might Find Helpful
Thread	Thread Starter	Forum	Replies	Last Post
a shell script for review.	robsonde	Shell Programming and Scripting	8	10-07-2009 05:11 AM
PHP Script to search muliplte files Urgent	krabu	Web Programming, Web 2.0 and Mashups	1	05-20-2009 07:33 AM
csh script to search for files and display result	neillsm	Shell Programming and Scripting	4	03-08-2009 12:05 PM
Please, review script.	algernonz	Shell Programming and Scripting	1	11-09-2008 09:01 PM
Review the Shell Script	srinivasvandana	Shell Programming and Scripting	2	11-09-2008 08:54 PM

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes	Rate This Thread
Switch to Linear Mode Hybrid Mode Switch to Threaded Mode	Rate This Thread: