I administer several websites that have just been subjected to the hacker described here: http://frazierit.com/blog/?p=103
I need to clear the code that has been injected into all php files.
A Crystaldawn user has made a cleaning script available here http://crystaldawn.net/fix_hack , but it needs to be run through a command line that I am unfamiliar with.
QUESTION: Is it possible to execute this script (below) using the submit button of an html form or similar? And if so, how?
Thanks in advance, I really appreciate any help, I need to clear 8 sites, and this can save me (and others) many hours.
<?php
define('CREATE_BACKUPS', FALSE);
if (!is_dir($argv[1]))
{
echo "You must enter a valid path such as /home/infected_dir or infected_dir for this script to function.\n";
exit;
}
$files = listdir($argv[1]);
foreach ($files as $filename)
{
if (file_extension($filename) == 'php')
{
$contents = file_get_contents($filename);
$backup = $contents;
$test = between('<?php', '<?php', $contents);
if (after('toolbarqueries', $test))
{
$contents = str_replace('<?php'.$test.'<?php', '<?php', $contents);
file_put_contents($filename, $contents);
if (CREATE_BACKUPS)
{
file_put_contents($filename.'.orig', $backup);
}
echo "$filename has been cleaned.\n";
}
}
}
function after ($this, $inthat)
{
if (!is_bool(strpos($inthat, $this)))
return substr($inthat, strpos($inthat,$this)+strlen($this));
};
function after_last ($this, $inthat)
{
if (!is_bool(strrevpos($inthat, $this)))
return substr($inthat, strrevpos($inthat, $this)+strlen($this));
};
function before ($this, $inthat)
{
return substr($inthat, 0, strpos($inthat, $this));
};
function before_last ($this, $inthat)
{
return substr($inthat, 0, strrevpos($inthat, $this));
};
function between ($this, $that, $inthat)
{
return before($that, after($this, $inthat));
};
function between_last ($this, $that, $inthat)
{
return after_last($this, before_last($that, $inthat));
};
function strrevpos($instr, $needle)
{
$rev_pos = strpos (strrev($instr), strrev($needle));
if ($rev_pos===false) return false;
else return strlen($instr) - $rev_pos - strlen($needle);
};
function listdir($dir='.') {
if (!is_dir($dir)) {
return false;
}
$files = array();
listdiraux($dir, $files);
return $files;
}
function listdiraux($dir, &$files) {
$handle = opendir($dir);
while (($file = readdir($handle)) !== false) {
if ($file == '.' || $file == '..') {
continue;
}
$filepath = $dir == '.' ? $file : $dir . '/' . $file;
if (is_link($filepath))
continue;
if (is_file($filepath))
$files[] = $filepath;
else if (is_dir($filepath))
listdiraux($filepath, $files);
}
closedir($handle);
}
function file_extension($filename)
{
$info = pathinfo($filename);
return $info['extension'];
}
?>