Finds primitive PHP backdoor crap in webroot. Each sequential run generates only diff (new or removed suspicious files since last run).

find-crap.sh

#!/usr/bin/env bash

LASTSCANLOG=/tmp/scanlog.txt
THISSCANLOG=/tmp/scanlog.new.txt

# Paths to search (space delimited)
PATHS="~/ ~/"

# Creates file, if it does not exist
touch $LASTSCANLOG

# Find crap
find $PATHS -name "*.php" -exec grep -niH " \(passthru\|shell_exec\|system\|phpinfo\|base64_decode\|popen\|exec\|proc_open\|pcntl_exec\|python_eval\|readfile\)\s*(" '{}' \; >$THISSCANLOG

# Show new or removed crap since last run
diff $LASTSCANLOG $THISSCANLOG

# Save this run as las turn
mv $THISSCANLOG $LASTSCANLOG