linux - xargs cannot find file paths supplied by input file -


first of all, not positive belongs here opposed serverfault or somewhere else. if belongs there instead, i'm sorry.

anyway, here's background issue. work company manages various clients' websites , 1 client have taken on has website lot of malware needs removed. now, have learned lot on past few weeks in terms of using grep, find, xargs, etc. find , perform actions on files have file names, file sizes, , contain strings or patterns of text.

one issue found images have been injected malicious exif data (basically, make attribute /.*/e , model attribute effect of eval(base64_decode(...)); encoded string php script allows attacker send post request attribute , runs input attribute through eval(). , then, have injected following code php script.

<?php $exif = exif_read_data('/path/to/image.jpg'); preg_replace($exif['make'],$exif['model'],''); ?> 

so replacing regular expression .* matches (including empty subject) php code accepts post request , executes given code. in essence, allows attacker execute php code want on client's website. interesting figure out, annoying fix.

php has tools read exif data (namely, exif_read_data()) , have used scan image files on client's website , compile list of images have injected malicious exif data. however, php not come equipped way modify data. so, did bit of research , found there linux program called "exiftools" lets alter exif data. installed , ran following command:

xargs -a files_with_malicious_exif.txt exiftool -make="" -model="" 

the text file there list of file paths, each on own line. script reads filename, because ouputs bunch of "error: file not found - ./path" messages (one each path).

the problem is, path exist, , if run following command:

exiftool -make="" -model="" ./path/that/does/exist/and/is/in/the/file/like/this.jpg 

it works. check file , 2 items in exif data has been cleaned.

but number of infected files rather high, , not go file file run command on each one.

i have tried use absolute path remove "./" file names. running correct directory relative paths work (as evidenced fact second command work relative path) still cannot find of files.

is there forgetting or not doing properly?

if set on using xargs, can attempt resolve issue through diagnostics, if goal job done, small little loop below work; if have filenames have special characters, need change $fixfile "$fixfile".

cat files_with_malicious_exif.txt | while read fixfile; exiftool -make="" -model="" $fixfile; done 

Comments

Popular posts from this blog

matlab - Deleting rows with specific rules -

php - MySQLi multi_query results for later use -