Finding r57 and c99 Shells Within Files

These commands will help you find the popular r57 and c99 shells hidden within php and image files – remember and run updatedb before running these commands.

To look within .php files:

find /  -name "*".php  -type f -print0  | xargs -0 grep r57 | uniq -c  

You can also search regular text (.txt) files:

find / -name "*".txt  -type f -print0  | xargs -0 grep r57 | uniq -c

Or even cleverly disguised GIF image files:

find /  -name "*".gif  -type f -print0  | xargs -0 grep r57 | uniq -c

If looking for c99 shells just replace the r57 with c99.

Advertisements

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s