Quick Search for php Backdoors

First, this is the php backdoor, Which is unquestionable.

As follows:

This is the case.

First, understand the linux grep command

Linux grep command

1. Role

In Linux, The grep command is a powerful text search tool that uses regular expressions to search for text and print Matching lines. Grep stands for Global Regular Expression Print, which indicates the Global Regular Expression version. Its permission is granted to all users.

2. Format

Grep [options]

3. Main Parameters

[Options] main parameters:

-C: only counts matching rows are output. -I: It is case-insensitive (only applicable to single characters ). -H: When querying multiple files, the file name is not displayed. -L: When querying multiple files, only names containing matching characters are output. -N: displays matching rows and row numbers. -S: the error message that does not exist or does not match the text is not displayed. -V: displays all rows that do not contain matched text.

Main Parameters of the regular expression pattern:

 

\: Ignore the original meaning of special characters in regular expressions. ^: Match the start line of the regular expression. $: Matches the end row of the regular expression. \ <: Starts from the row that matches the regular expression. \>: Ends with the row that matches the regular expression. []: A single character. For example, [A] indicates that A meets the requirements. [-]: Range, such as [A-Z], that is, A, B, C Until Z all meet the requirements.

. : All single characters.

*: It can contain 0 characters.

4. Run the grep command to use a simple instance.

$ Grep 'test' d *

Display all the lines containing test in files starting with d.

$ grep ‘test’ aa bb cc

The row Matching test is displayed in the aa, bb, and cc files.

$ grep ‘[a-z]\{5\}’ aa

Display All rows of a string that contains at least five consecutive lowercase characters.

$ grep ‘w\(es\)t.*\1′ aa

If west is matched, es is stored in the memory, marked as 1, and any characters (. *). These characters are followed by another es (\ 1). If they are found, the row is displayed. If you use egrep or grep-E, you do not need to escape it by using the "\" character. You can directly write it as 'W (es) t. * \ 1.

5. The grep command uses a complex instance

Suppose you are searching for a file with a character string 'Magic 'in the'/usr/src/Linux/doc' directory:

$ grep magic /usr/src/Linux/Doc/*sysrq.txt:* How do I enable the magic SysRQ key?sysrq.txt:* How do I use the magic SysRQ key?

The 'sysrp.txt 'file contains this string. The SysRQ function is discussed.

By default, 'grep' only searches for the current directory. If the directory contains many subdirectories, 'grep' is listed as follows:

Grep: sound: Is a directory

This may make the output of 'grep' difficult to read. There are two solutions:

Search for subdirectories: grep-r

Or ignore the subdirectory: grep-d skip

If there are many outputs, you can use the pipeline to convert them to 'less '. Read:

$ grep magic /usr/src/Linux/Documentation/* | less

In this way, you can read more conveniently.

Note that you must provide a file filtering method (* for searching all files *). If you forget, 'grep' will wait until the program is interrupted. If this happens, press <CTRL c> and try again.

The following are some interesting command line parameters:

 

Grep-I pattern files: searches case-insensitive. By default, it is case sensitive. grep-l pattern files: only names of matched files are listed. grep-L pattern files: names of unmatched files are listed. grep-w pattern files: only the entire word is matched, instead of a part of the string (such as matching 'Magic ', rather than 'magical'), grep-C number pattern files: The matched context displays the rows of [number], grep pattern1 | pattern2 files: show the rows matching pattern1 or pattern2, grep pattern1 files | grep pattern2: displays the rows matching both pattern1 and pattern2. Grep-n pattern files displays the row number information grep-c pattern files to find the total number of rows.

Here are some special symbols used for search:

\ <And \> respectively indicate the start and end of a word.

For example:

Grep man * matches 'Batman ', 'manic', 'Man ', etc. grep \ <man' * matches 'manic 'and 'man', but not 'Batman ', grep '\ <man \>' only matches 'man ', not other strings such as 'Batman' or 'manic. '^': Indicates the first row of the matched string, '$': indicates the end of the row of the matched string,

----------------------------------------------------------

Then, we use grep-r 'ss'/xxx/#. This command is used to match files with ss strings in the/xxx/directory.

Here is a simple example of killing

Eval is generally not used for writing programs, so eval is detected and killed here.

The command is as follows:

Grep-r 'eval'/home/jusker/shell

One-step deployment

Next, find the assert feature value.

Only

Grep-r 'assert '/home/jusker

 

Here, we will only explain how to scan and kill. For more information, see the advanced section.

Http://www.bkjia.com/Article/201405/304553.html