Home / server / Questions / 521194
Accepted
Fox
Asked: 2013-07-06 15:33:35 +0800 CST

Looking for a shell command to read non-binary part of most common image types

  • 772

A website I'm hosting on my dedicated server has been hacked. Some pictures have been infected with things like <?php eval(base64_decode(....));?>. I'm looking for a generic shell command which would able to read the headers of the most common image types (jpg, gif, tiff, etc.).

I tried jhead and others, jut jhead can only read EXIF data from JPG.

The aim is to find all infected images like this :

find -type f \( -iname "*jpg" -or -iname "*.jpeg" -or ... \) -exec sh -c 'magicimgheadersdisplay "{}" | grep eval" \;
php

2 Answers

  1. strings will display any printable bits it finds in a file. From there you can feed it into grep to find text within.

    • 2
  2. Best Answer

    grep -l can be used to report infected files. Try a command like 

    find -type f \( -iname "*jpg" -or -iname "*.jpeg" -or ... \) -print0 | xargs -0 grep -l '<?php eval(base64_decode'

    The -print0 and -0 arguments allow filenames and paths to contain spaces.

    • 0