Skip to content

Instantly share code, notes, and snippets.

@djaney
Created May 5, 2014 06:37
Show Gist options
  • Save djaney/4c13caf3dd2e2830ed13 to your computer and use it in GitHub Desktop.
Save djaney/4c13caf3dd2e2830ed13 to your computer and use it in GitHub Desktop.
Cleans injected malicious code in PHP.
<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
class Cleaner{
public function Cleaner($path){
$di = new RecursiveDirectoryIterator($path);
foreach (new RecursiveIteratorIterator($di) as $filename => $file) {
if($file->isFile() && $file->getExtension()=='php'){
$this->clean($filename);
}
}
}
function clean($filename){
$content = file_get_contents($filename);
// this is the pattern you want to remove
$replaced = preg_replace('/\<\?php.*\!function_exists\(\'lowrcwdebo\'\)\) \{ function lowrcwdebo.*\?\>/','',$content);
if($content==$replaced){
echo 'Checked: '.$filename . PHP_EOL;
}else{
file_put_contents($filename, $replaced);
$log = 'Cleaned: '.$filename . PHP_EOL;
file_put_contents ( 'cleaner.log' ,$log, FILE_APPEND);
echo $log;
}
}
}
$path = $argv[1];
$c = new Cleaner($path);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment