shell finder

[Vlachs]

#!/usr/bin/env bash
# Identifies instances of the c99Shell PHP trojan within PHP files

FIND_LOC=${1:-/var/www/html/} # Root the find by the a directory provided as argument or default to root
echo "Starting search from $FIND_LOC..."
find $FIND_LOC -type f -iname '*.php' -exec grep -qi 'C99Shell' '{}' \; -print
echo "Complete"

sudo find <search dirs here>/* -exec /bin/bash -c 'egrep -l "(\/tmp\/cmdtemp|SnIpEr_SA|Bhlynx|x2300|c99shell|r57shell|milw0rm|g00nshell|locus7|MyShell|PHP\ Shell|phpshell|PHPShell|PHPKonsole|Haxplorer|phpRemoteView|w4ck1ng|PHP-Proxy|Locus7s|ccteam|phpConfigSpy|RAPIDLEECH|replyto.txt)" "$1" >> <your dir here>/shellcheck.cz' -- "{}" \;

[ANdreicj]

Hehe, mersi benny !.