Question

My web server got hacked (Despite the security team telling me nothing was compromised) and an uncountable number of files have an extra line of PHP code generating a link to some Vietnamese website.

Given there are tens of thousands of files across my server, is there a way I can go in with SSH and remove that line of code from every file it’s found in?

Please be specific in your answer, I have only used SSH a few times for some very basic tasks and don’t want to end up deleting a bunch of my files!

Answer 1

Yes, a few lines of shell script would do it. I hesitate to give it to you, though, as if something goes wrong I’ll get blamed for messing up your web server. That said, the solution could be as simple as this:

for i in `find /where/ever -name '*.php'`; do
    mv $i $i.bak
    grep -v "http://vietnamese.web.site" $i.bak >> $i
done

This finds all the *php files under /where/ever, and removes any lines that have http://vietnamese.web.site in them. It makes a *.bak copy of every file. After you run this and all seems good, you could delete the backups with

find . -name '*.php.bak' -exec rm \{\} \;

Your next task would be to find a new provider, as not only did they get hacked, but they apparently don’t keep backups. Good luck.