From owner-freebsd-questions@FreeBSD.ORG  Fri Dec  5 09:39:24 2008
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 3AD151065672
	for <freebsd-questions@freebsd.org>;
	Fri,  5 Dec 2008 09:39:24 +0000 (UTC)
	(envelope-from fbsd.questions@rachie.is-a-geek.net)
Received: from mail.rachie.is-a-geek.net (rachie.is-a-geek.net [66.230.99.27])
	by mx1.freebsd.org (Postfix) with ESMTP id 0A7458FC1E
	for <freebsd-questions@freebsd.org>;
	Fri,  5 Dec 2008 09:39:23 +0000 (UTC)
	(envelope-from fbsd.questions@rachie.is-a-geek.net)
Received: from localhost (mail.rachie.is-a-geek.net [192.168.2.101])
	by mail.rachie.is-a-geek.net (Postfix) with ESMTP id 0AB24AFBC02;
	Fri,  5 Dec 2008 00:39:23 -0900 (AKST)
From: Mel <fbsd.questions@rachie.is-a-geek.net>
To: freebsd-questions@freebsd.org,
 mcoyles@horbury.wakefield.sch.uk
Date: Fri, 5 Dec 2008 10:39:21 +0100
User-Agent: KMail/1.9.7
References: <002b01c95609$ed0c7200$c7255600$@wakefield.sch.uk>
	<200812050551.32850.fbsd.questions@rachie.is-a-geek.net>
	<004c01c956ba$56497410$02dc5c30$@wakefield.sch.uk>
In-Reply-To: <004c01c956ba$56497410$02dc5c30$@wakefield.sch.uk>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200812051039.21913.fbsd.questions@rachie.is-a-geek.net>
Cc: 
Subject: Re: Mass find/replace...
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 05 Dec 2008 09:39:24 -0000

On Friday 05 December 2008 10:17:46 Marc Coyles wrote:
> > + not \; or you will fork on every result.
> >
> > Additionally, is this injected code one long string or broken down
> > by the
> > mailer? Grep isn't the best way to deal with it. It's pretty easy
> > to correct
> > with perl, bit trickier if it's multiline, still not too hard:
> >
> > find /home/horbury -type f -exec \
> > 	perl -pi.bak -e 's,<\? /\*\*/eval\(base64_decode\(.*?\?>,,s' {} +
>
> Sadly that didn't work. It created .bak files for everything within
> /home/Horbury recursively, but didn't make any changes - the base64_decode
> is till present.
>
> Additional point to note: this only needs performing on .php files, not all
> files...
>
> Would I be correct in guessing it's because the string for perl to search
> for omits a space?

Nope.

> IE: within the files, it's as follows:
> <?php /**/eval(base64_decode('thestring')); ?>

Cause in your original mail I didn't catch the <?php, but the shorthand open. 
So it should be:

's,<\?php /\*\*/eval\(base64_decode\(.*?\?>,,s'

> Whereas the perl appears to be looking for:
> <?php/**/eval(base64_decode(*wildcard*?>
>
> Also... how to delete all files ending in .bak recursively? *grin*
>
> I'm presuming it'd be:
>
> Find /home/horbury -type f -name "*.bak" -exec \

find /home/horbury -name '*.bak' -delete

-- 
Mel

Problem with today's modular software: they start with the modules
    and never get to the software part.