Question

I’ve been wrestling with a grep issue, in attempt to reverse a server-wide hack on my server, but grep doesn’t seem to be able to search inside jpg files when run as a shell, but the grep command on it’s own works file in ssh.

this returns results fine:
grep -l -R “nastycode” /var/www/vhosts

but when run as a shell script, it doesn’t find the jpgs anymore.

for file in $(grep -l -R "nastycode" /var/www/vhosts)
 do
  sed -e "s/"nastycode"/"nicecode"/ig" $file > /tmp/tempfile.tmp
  mv /tmp/tempfile.tmp $file
  echo "Modified: " $file
 done

Q: Could it be to do with the ‘for file in’ part?
Q: inside our search pattern “nastycode”, can we search for things which have regexp chars but treat them as normal ($,|? etc)?

thanks in advance.

Nicholas

Answer 1

grep has an option to ignore special characters (-F) as long as there are no newlines. sed, unfortunately, has no such option. If there are special characters in it, they must be escaped. If you have a lot of /s in it, you can avoid having to escape them by changing the delimiter – s|old|new| or s@old@new@, or some other character your code doesn’t contain. Regarding the rest of the structure, I have a couple comments. First, you should never use that for file in command structure, it will break on white space; use ** (you may need to enable it with shopt -s globstar first) or find instead. Next, GNU sed has an inline option, -i. You can also specify a backup suffix for it (-i.bak, for instance). As sed only changes if it finds a pattern, there’s really no reason to use grep to limit the files anyway.

Putting those all together, (once you get your regex escaped – we can help with that too if you need it) you can use these:

# Globstar
for file in /var/www/vhosts/**; do
    sed -i.bak 's/) || stristr(\$ua/) \&\&false || stristr($ua/ig' $file
done

# find
find /var/www/vhosts -type f -exec sed -i.bak 's/) || stristr(\$ua/) \&\&false || stristr($ua/ig' {} \;

# If you really want the echo notification
find /var/www/vhosts -type f -exec grep -qiF ') || stristr($ua' {} \; -exec sed -i.bak 's/) || stristr(\$ua/) \&\&false || stristr($ua/ig' {} + -printf "Modified %p\n"