Visit Our UNIX and Linux User Community

Please review script for search in all files

Thread Tools Search this Thread
Top Forums Shell Programming and Scripting Please review script for search in all files
# 1  
Old 11-02-2009
Please review script for search in all files

I have written a little script to scan users home directories for certain commands located inside a file. The script is setup to include a small help section and allows for passing a username argument to override scanning of all users home directories.

A lot of searching and trial and error has went into this script on my part. I would appreciate it if some of you that actually know what you're doing can take a look at it for me. If you could give me some pointers, ideas, or suggestions I would be grateful.


# default folder we will scan

# a list of commands we need to check for
# seperate commands with a pipe |

function help {
  # setup small help list
  echo -e "Pass an aurgument via command line or run without args."
  echo -e "   example: ./ -u username\n"
  echo -e "  -u\t pass a username to run against a single account."
  echo -e "  -h\t This help message.\n"

function scanDir {
  # check if $1 else scan all user homes
  if [ "$1" ]; then
    # do stuff on single user
    if [ -d "$DIR/$1" ]; then
      echo "User not found in the \$HOME directory"
    # scan all home directories where a user account exists
    list=`grep $DIR /etc/passwd | cut -d: -f6`

  echo "Checking files for $LOOKFOR."
  for i in $list; do
    if [ -d "$path" ]; then
      # check if our path is a directory
      echo "Checking $i/public_html/"
      grep -H -E $LOOKFOR $i/public_html/* -R | cut -d: -f1
      echo "No files to check; $path not a directory."

while getopts  "hu:" flag
  case $flag in
    u )
      # echo "$flag" $OPTIND $OPTARG
      # read flag and pass to scanDir function
      scanDir $OPTARG
    h )
      # if h call help function
    * )
      echo -e "Invalid option. Please use -h for help.\n"

# no options passed scan all

Best Regards,
# 2  
Old 11-03-2009
Hi Brandon,

I took a look at your script. IMO it is nicely written, but the actual content strikes me as a bit thin to justify a whole script. By and large, the work involved could be accomplished with the following command:

grep -H -E '@system|@shell_exec|@include|@shell' /home/*/public_html/* -R | cut -d: -f1

Also I do not get what the @-signs are for. Is that syntax of the files you are checking?
# 3  
Old 11-03-2009
Yes, the @symbols are part of what is being checked. The current list is just preliminary and is not complete.

To give a little background. I run a small hosting company. One of my clients was running Zen Cart and it was exploited. While I was doing some of the forensic investigation to find out the cause and the damage, I thought a script to search for certain keywords used in the attack scripts could come in handy.

Once I make sure everything is coded the right way I plan on sharing this with other server admins in a similar situation. Which is why the added stuff to allow for checking a single users public_html directory exists.

I started off with a one liner but during testing found some issues. Checking /home/*/public_html has some drawbacks to my particular situation. I am running a Cpanel server and there are a few non-user directories located in the /home/.

Thanks for the feedback.

IMO it is nicely written,
P.S. Thank You. I have to admit this is a testament to the quality of help available on this site and others like it.

Last edited by bkeep; 11-03-2009 at 01:01 AM..
# 4  
Old 11-03-2009
Just a small suggestion to that.

Instead of grep and cut - try using awk - one process without any kernel data structure.
# 5  
Old 11-03-2009
Thanks for the reply. Regarding "one process without any kernel data structure", can you elaborate on what you said or post a link? I don't understand what you are talking about. I guess I am going a little deeper down the rabbit hole then I have been before.
edit: I Googled it Kernel Data Structures

I have seen a few posts saying cut is faster then awk and awk is more flexible. To be honest, I don't have a clue. The best I could come up with using awk, was only for part of the process. When I tried using awk in a similar fashion to my existing code I was getting directory errors since part of what was being passed was a directory. I did try something on my own using cut to get multiple fields, I couldn't figure out how to do it or if it was possible.

So this is the sample awk code I have.
grep -n -E $LOOKFOR $i/public_html/* -R | awk -F":" '{print $1, $2, $3}'

I will say awk is more flexible than cut in this instance. It took me awhile just to figure that out. Could you post an example of what you were referring to, without using grep or cut?

Currently, I am getting output similar to this using awk or cut.
Checking /home/user/public_html/
/home/user/public_html/feed1.php 467 @include("FeedForAll_rss2html_pro.php");
/home/user/public_html/feed1.php 483 @include("FeedForAll_Scripts_CachingExtension.php");
/home/user/public_html/feed1.php 485 @include_once("");
/home/user/public_html/feed2.php 467 @include("FeedForAll_rss2html_pro.php");
/home/user/public_html/feed2.php 483 @include("FeedForAll_Scripts_CachingExtension.php");
/home/user/public_html/feed2.php 485 @include_once("");
/home/user/public_html/feed3.php 467 @include("FeedForAll_rss2html_pro.php");
/home/user/public_html/feed3.php 483 @include("FeedForAll_Scripts_CachingExtension.php");
/home/user/public_html/feed3.php 485 @include_once("");

Is there a way to get output more like this?
Checking /home/user/public_html/
   467 @include("FeedForAll_rss2html_pro.php");
   483 @include("FeedForAll_Scripts_CachingExtension.php");
   485 @include_once("");
   467 @include("FeedForAll_rss2html_pro.php");
   483 @include("FeedForAll_Scripts_CachingExtension.php");
   485 @include_once("");
   467 @include("FeedForAll_rss2html_pro.php");
   483 @include("FeedForAll_Scripts_CachingExtension.php");
   485 @include_once("");

Best Regards,

---------- Post updated at 06:23 AM ---------- Previous update was at 01:23 AM ----------

I have finally came up with this and it works ok but it is getting a little unruly.
edit: Broken after pipe for less scrolling and removed a few spaces too.
grep -InE $LOOKFOR $i/public_html/* -R |
awk -F":" '!a[$1]++{gsub(/ */," ",$3); print $1,"\n Line:" $2, $3; next} {gsub(/ */," ",$3); print" Line:" $2, $3}'

How do I remove tabs and double spaces?

I think there has to be a better way then this. I just don't know what it is.
Any help is appreciated.


Last edited by bkeep; 11-03-2009 at 04:12 PM..
# 6  
Old 11-03-2009
How about:
grep -InE $LOOKFOR $i/public_html/* -R |awk -F: 'NR==1{print;next} p!=$1{p=$1;print p}{print "  "$2,$3}'

# 7  
Old 11-03-2009
Thanks for the info.

I made a small change.
Broken after pipe to reduce screen scrolling.
grep -InE $LOOKFOR $i/public_html/* -R |
awk -F: 'NR==1{print $1,"\n" $2,$3; next} p!=$1{p=$1; print p} {print "   " $2,$3}'

I get output like this
   34   <?php /*old includehook*/ @include(dirname(__FILE__).'/meta.html')?>
   38 <?php /*old includehook*/ @include(dirname(__FILE__).'/topheader.html')?>
   55     <?php /*old includehook*/ @include(dirname(__FILE__).'/header.html')?>
   36   <?php /*old includehook*/ @include(dirname(__FILE__).'/meta.html')?>
   40 <?php /*old includehook*/ @include(dirname(__FILE__).'/topheader.html')?>
   60     <?php /*old includehook*/ @include(dirname(__FILE__).'/header.html')?>

Is there an easy way to get consistent column widths for fields $2 $3?

Something like this is what I am after, The $3 has a variable length of whitespace and tabs that I would like to remove if at all possible, then add something like 4 spaces back in front.
   34    <?php /*old includehook*/ @include(dirname(__FILE__).'/meta.html')?>
   38    <?php /*old includehook*/ @include(dirname(__FILE__).'/topheader.html')?>
   55    <?php /*old includehook*/ @include(dirname(__FILE__).'/header.html')?>
   36    <?php /*old includehook*/ @include(dirname(__FILE__).'/meta.html')?>
   40    <?php /*old includehook*/ @include(dirname(__FILE__).'/topheader.html')?>
   123   <?php /*old includehook*/ @include(dirname(__FILE__).'/header.html')?>

Thanks again for the help.

Previous Thread | Next Thread
Test Your Knowledge in Computers #643
Difficulty: Easy
From the beginning, the operating system of NeXTSTEP was built upon Mach/BSD.
True or False?

8 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Peer Review File/Folder Script

Hello *nix friends, I've written a shell script that allow web admin's to copy file/folder from a development site to the production site. It's more or less a poor man SVN. I'm posting the script here because I was able to get many questions answered through this forum and also, I want to... (4 Replies)
Discussion started by: rwhite35
4 Replies

2. Shell Programming and Scripting

Please review error routines in my ksh script

The script distributes files from an AIX server using iether ftp or sftp depending on the constraint of the destination server. I am interested in having the error checking routine critically reviewed. I will only include an excerpt from the script concerning error trapping: (where $FTP_OUT is the... (7 Replies)
Discussion started by: peleton
7 Replies

3. UNIX for Dummies Questions & Answers

Script to search and copy files

HI everyone, I been to this site before for help and found my answers on other threads now I am posting my own :). I have a list of file names with out extensions on an txt file. I need a way for the script to search on the server for each file name and copy the files over to a new directory.... (12 Replies)
Discussion started by: sergiol
12 Replies

4. Shell Programming and Scripting

shell script to search and copy files

Hello Im new to this forums, I would like some help regarding a script that I need in order to copy some files. Heres the scenario: I need to search several files which have a particular code inside, lets say "test" all of them on different directories. I need to copy all of them on a new... (4 Replies)
Discussion started by: c.watson
4 Replies

5. Shell Programming and Scripting

a shell script for review.

I have written a bit of shell that lets our company check all our SSL certs. the aim is to have a list of servers and run this check from cron once a week. Our managers have decided that we will not run BASH, so it has been written in /bin/sh and only needs openssl, no perl, no bash, no extra... (8 Replies)
Discussion started by: robsonde
8 Replies

6. Shell Programming and Scripting

Review Check list for Unix Shell Script

Hi, I need Unix Shell Script Review Check list in the format of word or excel. Can any one provide the review checklist for unix shell script. Pls. (1 Reply)
Discussion started by: praka
1 Replies

7. Shell Programming and Scripting

Please, review script.

Hi guys, I 've been brewing this shellscript, but I can't test it until next tuesday. In the meantime I am too curious wether it will work or not, so I'd like to hear your comments. Background: I want to watch the user quota for mailboxes in various email-domains on a IMAP-server. I have... (1 Reply)
Discussion started by: algernonz
1 Replies

8. Shell Programming and Scripting

Review the Shell Script

Hi, I want to copy all the log file except current date log from one server to another server. Log File will be like this LOGNIG_08_11_2008*.log For this cd /test/log date -d '1 day ago' "+%d_%m_%Y" -->This command gives previous day scp LOGSNIG_date -d '1 day ago' "+%d_%m_%Y"... (2 Replies)
Discussion started by: srinivasvandana
2 Replies

Featured Tech Videos