i'll keep explanation of why need mimimum. 1 of file directories got hacked through xss , placed long string @ beginning of php
files. i've tried use sed
replace string nothing won't work because pattern match includes many many characters need escaped.
i found out can use fgrep
match fixed string saved in pattern file, i'd replace matched string (not line) in each file, grep
's -v
inverts result on line, rather end of matched string.
this command i'm using on example file contains hacked
fgrep -v -f ~/hacked-string.txt example.php
i need output contain <?php
that's @ end of line (sometimes it's <style>
tag), -v
option inverts @ end of line, output doesn't contain <?php
@ beginning.
note
i've tried use -o
or --only-matching
outputs nothing instead:
fgrep -f ~/hacked-string.txt example.php --only-matching -v
is there option in grep can use invert on end of matched pattern, rather line pattern matched? or alternatively, there easier option replace hacked string in .php
files?
here small snippet of what's in hacked-string.txt
(line breaks added readability):
]55ld]55#*<%x5c%x7825bg9}:}.}-}!#*<%x55c%x7825) dfyfr%x5c%x7827tfs%x5c%x7c%x785c%x5c%x7825j:^<! %x5c%x7825w%x5c%x7860%x5c%x785c^>ew:25tww**wysb oepn)%x5c%x7825bss-%x5c%x7825r%x5c%x7878b%x5c%x 7825h>#]y3860msvd},;uqpuft%x5c%x7860msvd}+;!>!} %x5c%x7827;!%x5c%x7825v%x5c%x7827{ftmfv%x5e56+9 9386c6f+9f5d816:+946:ce44#)zbssb!>!ssbnpe_gmft% x5c5c%x782f#00#w~!%x5c%x7825t2w)##qtjw)#]82#-#! #-%x5c%x7825tmw)%x5c%x78w6*%x5c%x787f_*#fubfsdx k5%x5c%xf2!>!bssbz)%x5c%x7824]25%x5c%x7824-8257 -k)fujs%x5c%x7878x6<#o]o]y%x5c%x78257;utpi#7>-1 -bube{h%x5c%x7825)sutcvt)!gj!|!*bubepqsut>j%x5c %x7825!*72!%x5c%x7827!hmg%x5c%x78225>2q%x5c%x7
thanks in advance!
i think asking this:
"is possible use grep utility remove instances of fixed string (which might contain lots of regex metacharacters) file?"
in case, answer "no".
what think wanted ask was:
"what easiest way remove instances of fixed string (which might contain lots of regex metacharacters) file?"
here's 1 reasonably simple solution:
delete_string() { awk -v s="$the_string" '{while(i=index($0,s))$0=substr($0,1,i-1)substr($0,i+length(s))}1' } delete_string 'some_hideous_string_with*!"_inside' < original_file > new_file
the shell syntax fragile; break if string contains apostrophe ('). however, can read raw string stdin variable with:
$ ifs= read -r the_string absolutely here
which work string doesn't contain newline or nul character. once have string in variable, can use above function:
delete_string "$the_string" < original_file > new_file
here's possible 1 liner, using python:
delete_string() { python -c 'import sys;[sys.stdout.write(l.replace(r"""'"$1"'""","")) l in sys.stdin]' }
this won't handle strings have 3 consecutive quotes ("""
).
Comments
Post a Comment