How to call a PHP script using html form elements instead of the command line?

I administer several websites that have just been subjected to the hacker described here: http://frazierit.com/blog/?p=103

I need to clear the code that has been injected into all php files.

A Crystaldawn user has made a cleaning script available here http://crystaldawn.net/fix_hack , but it needs to be run through a command line that I am unfamiliar with.

QUESTION: Is it possible to execute this script (below) using the submit button of an html form or similar? And if so, how?

Thanks in advance, I really appreciate any help, I need to clear 8 sites, and this can save me (and others) many hours.

<?php
//Create back files?
define('CREATE_BACKUPS', FALSE);

if (!is_dir($argv[1]))
{
   echo "You must enter a valid path such as /home/infected_dir or infected_dir for this script to function.\n";
   exit;
}

//Search the path for all php files, opening each one, and checking to see if it infected

//First, get an array list of all valid .php files.


$files = listdir($argv[1]);
foreach ($files as $filename)
{
   //We only need to check php files, so we add that here
   if (file_extension($filename) == 'php')
   {
      //This is a php file so lets check it to see if it infected.
      $contents = file_get_contents($filename);
      $backup = $contents;

      //There will always be 2 opening tags in an infected file and since the hack is always at the top, it easiest to test for this right away.
      $test = between('<?php', '<?php', $contents);

      //This particular hack likes to use toolbarqueries so we test to see if our chunk is an infected chunk.  If your website uses this url somehow, then add extra if statements as necessary.
      if (after('toolbarqueries', $test))
      {
         //This chunk is infected.  So lets replace it and resave the file.
         $contents = str_replace('<?php'.$test.'<?php', '<?php', $contents);

         //Now save it! Woohoo!
         file_put_contents($filename, $contents);
         if (CREATE_BACKUPS)
         {
            file_put_contents($filename.'.orig', $backup);
         }

         echo "$filename has been cleaned.\n";
      }
   }
}

function after ($this, $inthat)
    {
        if (!is_bool(strpos($inthat, $this)))
        return substr($inthat, strpos($inthat,$this)+strlen($this));
    };

    function after_last ($this, $inthat)
    {
        if (!is_bool(strrevpos($inthat, $this)))
        return substr($inthat, strrevpos($inthat, $this)+strlen($this));
    };

    function before ($this, $inthat)
    {
        return substr($inthat, 0, strpos($inthat, $this));
    };

    function before_last ($this, $inthat)
    {
        return substr($inthat, 0, strrevpos($inthat, $this));
    };

    function between ($this, $that, $inthat)
    {
     return before($that, after($this, $inthat));
    };

    function between_last ($this, $that, $inthat)
    {
     return after_last($this, before_last($that, $inthat));
    };

    // USES
    function strrevpos($instr, $needle)
    {
        $rev_pos = strpos (strrev($instr), strrev($needle));
        if ($rev_pos===false) return false;
        else return strlen($instr) - $rev_pos - strlen($needle);
    };

    function listdir($dir='.') {
    if (!is_dir($dir)) {
        return false;
    }

    $files = array();
    listdiraux($dir, $files);

    return $files;
}

function listdiraux($dir, &$files) {
    $handle = opendir($dir);
    while (($file = readdir($handle)) !== false) {
        if ($file == '.' || $file == '..') {
            continue;
        }
        $filepath = $dir == '.' ? $file : $dir . '/' . $file;
        if (is_link($filepath))
            continue;
        if (is_file($filepath))
            $files[] = $filepath;
        else if (is_dir($filepath))
            listdiraux($filepath, $files);
    }
    closedir($handle);
}

function file_extension($filename)
{
   $info = pathinfo($filename);
   return $info['extension'];
}
?>
+1
source share
3

script. - "cleanupscript.php", :

http://yoursite.com/cleanupscript.php

.

$argv[1] = '/path/to/your/site/document/root'; script, .

+1

$_POST. , action script, $_POST.

script.

0

script -. :

  • $argv, . script - ( HTML-), .

  • script . - .

script ,

php <script_name> <path_to_direcotry>

<script_name> - Crystaldawn script, <path_to_directory> - , .

, $argv - :

$_GET['directory'];

script :

http://yourwebsite/script_name.php?directory=/home/www/

, , , - directory.

-, , - .

0

All Articles