{"id":6281,"date":"2014-12-01T14:04:41","date_gmt":"2014-12-01T19:04:41","guid":{"rendered":"http:\/\/g33kinfo.com\/info\/?p=6281"},"modified":"2014-12-01T14:04:41","modified_gmt":"2014-12-01T19:04:41","slug":"6281","status":"publish","type":"post","link":"https:\/\/g33kinfo.com\/info\/6281\/","title":{"rendered":"CryptoPHP Detection Script"},"content":{"rendered":"

From https:\/\/github.com\/fox-it\/cryptophp\/tree\/master\/scripts<\/a><\/p>\n

fox-it made the following Python scripts to help administrators to detect and identify CryptoPHP. The scripts will require Python (preferably 2.7) to run.<\/p>\n

RAW: https:\/\/raw.githubusercontent.com\/fox-it\/cryptophp\/master\/scripts\/check_filesystem.py<\/a>
\n<\/p>\n

Install:
\ncd \/usr\/local\/src
\nwget --no-check-certificate https:\/\/raw.githubusercontent.com\/fox-it\/cryptophp\/master\/scripts\/check_filesystem.py
\nchmod +x check_filesystem.py
\n.\/check_filesystem.py \/home <\/code><\/p>\n

Example Usage:<\/p>\n

.\/check_filesystem.py --help
\nUsage: check_filesystem.py [options] directory|file [directory2|file2] [..]<\/p>\n

Options:
\n -h, --help show this help message and exit
\n -n, --no-color no color output [default: False]
\n -p PATTERNS, --patterns=PATTERNS
\n scan only files matching the patterns (comma
\n seperated) [default: *.png,*.gif,*.jpg,*.bmp]<\/code><\/p>\n

To scan your whole system (it can take a while), run:
\n.\/check_filesystem.py<\/code><\/p>\n

Or scan a specific directory, for example \/home:
\n.\/check_filesystem.py \/home<\/code><\/p>\n

Files will either reported as suspicious or confirmed CryptoPHP shell as follows:<\/p>\n

File matching patterns: ['*.png', '*.gif', '*.jpg', '*.bmp']
\nRecursively scanning directory: \/
\n \/home\/www\/social.png: CRYPTOPHP DETECTED! (version: 1.0)
\n \/var\/www\/images\/social.png: CRYPTOPHP DETECTED! (version: 1.0a)
\n \/tmp\/thumbs\/admin\/assets\/images\/thumb.png: CRYPTOPHP DETECTED! (version: 0.3x555)<\/code><\/p>\n

The pattern for file matching can be changed using the –patterns. For example to scan all files you could specify:
\n$ .\/check_filesystem.py --patterns '*.*' \/home
\nFile matching patterns: ['*']
\nRecursively scanning directory: \/home<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"

From https:\/\/github.com\/fox-it\/cryptophp\/tree\/master\/scripts fox-it made the following Python scripts to help administrators to detect and identify CryptoPHP. The scripts will require Python (preferably 2.7) to run. RAW: https:\/\/raw.githubusercontent.com\/fox-it\/cryptophp\/master\/scripts\/check_filesystem.py… <\/p>\n

Read More<\/i><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-6281","post","type-post","status-publish","format-standard","hentry","category-info"],"yoast_head":"\nCryptoPHP Detection Script - Linux Shtuff<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/g33kinfo.com\/info\/6281\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CryptoPHP Detection Script - Linux Shtuff\" \/>\n<meta property=\"og:description\" content=\"From https:\/\/github.com\/fox-it\/cryptophp\/tree\/master\/scripts fox-it made the following Python scripts to help administrators to detect and identify CryptoPHP. The scripts will require Python (preferably 2.7) to run. RAW: https:\/\/raw.githubusercontent.com\/fox-it\/cryptophp\/master\/scripts\/check_filesystem.py... Read More\" \/>\n<meta property=\"og:url\" content=\"https:\/\/g33kinfo.com\/info\/6281\/\" \/>\n<meta property=\"og:site_name\" content=\"Linux Shtuff\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/fb.me\/g33kinf0\" \/>\n<meta property=\"article:author\" content=\"https:\/\/fb.me\/g33kinf0\" \/>\n<meta property=\"article:published_time\" content=\"2014-12-01T19:04:41+00:00\" \/>\n<meta name=\"author\" content=\"g33kadmin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/twitter.com\/drsinger1111\" \/>\n<meta name=\"twitter:site\" content=\"@drsinger1111\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/6281\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/6281\\\/\"},\"author\":{\"name\":\"g33kadmin\",\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/#\\\/schema\\\/person\\\/c022e4c40b13ea1b678e6f020756f547\"},\"headline\":\"CryptoPHP Detection Script\",\"datePublished\":\"2014-12-01T19:04:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/6281\\\/\"},\"wordCount\":100,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/#\\\/schema\\\/person\\\/c022e4c40b13ea1b678e6f020756f547\"},\"articleSection\":[\"General Info\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/g33kinfo.com\\\/info\\\/6281\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/6281\\\/\",\"url\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/6281\\\/\",\"name\":\"CryptoPHP Detection Script - Linux Shtuff\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/#website\"},\"datePublished\":\"2014-12-01T19:04:41+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/6281\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/g33kinfo.com\\\/info\\\/6281\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/6281\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CryptoPHP Detection Script\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/#website\",\"url\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/\",\"name\":\"Linux Shtuff\",\"description\":\"Because I have CRS Syndrome...\",\"publisher\":{\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/#\\\/schema\\\/person\\\/c022e4c40b13ea1b678e6f020756f547\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/#\\\/schema\\\/person\\\/c022e4c40b13ea1b678e6f020756f547\",\"name\":\"g33kadmin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/wp-content\\\/uploads\\\/2022\\\/07\\\/minion-researchA.gif\",\"url\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/wp-content\\\/uploads\\\/2022\\\/07\\\/minion-researchA.gif\",\"contentUrl\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/wp-content\\\/uploads\\\/2022\\\/07\\\/minion-researchA.gif\",\"width\":512,\"height\":512,\"caption\":\"g33kadmin\"},\"logo\":{\"@id\":\"https:\\\/\\\/g33kinfo.com\\\/info\\\/wp-content\\\/uploads\\\/2022\\\/07\\\/minion-researchA.gif\"},\"description\":\"I am a g33k, Linux blogger, developer, student and Tech Writer for Liquidweb.com\\\/kb. My passion for all things tech drives my hunt for all the coolz. I often need a vacation after I get back from vacation....\",\"sameAs\":[\"https:\\\/\\\/thelinuxreport.com\",\"https:\\\/\\\/fb.me\\\/g33kinf0\",\"https:\\\/\\\/x.com\\\/https:\\\/\\\/twitter.com\\\/drsinger1111\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CryptoPHP Detection Script - Linux Shtuff","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/g33kinfo.com\/info\/6281\/","og_locale":"en_US","og_type":"article","og_title":"CryptoPHP Detection Script - Linux Shtuff","og_description":"From https:\/\/github.com\/fox-it\/cryptophp\/tree\/master\/scripts fox-it made the following Python scripts to help administrators to detect and identify CryptoPHP. The scripts will require Python (preferably 2.7) to run. RAW: https:\/\/raw.githubusercontent.com\/fox-it\/cryptophp\/master\/scripts\/check_filesystem.py... Read More","og_url":"https:\/\/g33kinfo.com\/info\/6281\/","og_site_name":"Linux Shtuff","article_publisher":"https:\/\/fb.me\/g33kinf0","article_author":"https:\/\/fb.me\/g33kinf0","article_published_time":"2014-12-01T19:04:41+00:00","author":"g33kadmin","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/twitter.com\/drsinger1111","twitter_site":"@drsinger1111","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/g33kinfo.com\/info\/6281\/#article","isPartOf":{"@id":"https:\/\/g33kinfo.com\/info\/6281\/"},"author":{"name":"g33kadmin","@id":"https:\/\/g33kinfo.com\/info\/#\/schema\/person\/c022e4c40b13ea1b678e6f020756f547"},"headline":"CryptoPHP Detection Script","datePublished":"2014-12-01T19:04:41+00:00","mainEntityOfPage":{"@id":"https:\/\/g33kinfo.com\/info\/6281\/"},"wordCount":100,"commentCount":0,"publisher":{"@id":"https:\/\/g33kinfo.com\/info\/#\/schema\/person\/c022e4c40b13ea1b678e6f020756f547"},"articleSection":["General Info"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/g33kinfo.com\/info\/6281\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/g33kinfo.com\/info\/6281\/","url":"https:\/\/g33kinfo.com\/info\/6281\/","name":"CryptoPHP Detection Script - Linux Shtuff","isPartOf":{"@id":"https:\/\/g33kinfo.com\/info\/#website"},"datePublished":"2014-12-01T19:04:41+00:00","breadcrumb":{"@id":"https:\/\/g33kinfo.com\/info\/6281\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/g33kinfo.com\/info\/6281\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/g33kinfo.com\/info\/6281\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/g33kinfo.com\/info\/"},{"@type":"ListItem","position":2,"name":"CryptoPHP Detection Script"}]},{"@type":"WebSite","@id":"https:\/\/g33kinfo.com\/info\/#website","url":"https:\/\/g33kinfo.com\/info\/","name":"Linux Shtuff","description":"Because I have CRS Syndrome...","publisher":{"@id":"https:\/\/g33kinfo.com\/info\/#\/schema\/person\/c022e4c40b13ea1b678e6f020756f547"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/g33kinfo.com\/info\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/g33kinfo.com\/info\/#\/schema\/person\/c022e4c40b13ea1b678e6f020756f547","name":"g33kadmin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/g33kinfo.com\/info\/wp-content\/uploads\/2022\/07\/minion-researchA.gif","url":"https:\/\/g33kinfo.com\/info\/wp-content\/uploads\/2022\/07\/minion-researchA.gif","contentUrl":"https:\/\/g33kinfo.com\/info\/wp-content\/uploads\/2022\/07\/minion-researchA.gif","width":512,"height":512,"caption":"g33kadmin"},"logo":{"@id":"https:\/\/g33kinfo.com\/info\/wp-content\/uploads\/2022\/07\/minion-researchA.gif"},"description":"I am a g33k, Linux blogger, developer, student and Tech Writer for Liquidweb.com\/kb. My passion for all things tech drives my hunt for all the coolz. I often need a vacation after I get back from vacation....","sameAs":["https:\/\/thelinuxreport.com","https:\/\/fb.me\/g33kinf0","https:\/\/x.com\/https:\/\/twitter.com\/drsinger1111"]}]}},"_links":{"self":[{"href":"https:\/\/g33kinfo.com\/info\/wp-json\/wp\/v2\/posts\/6281","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/g33kinfo.com\/info\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/g33kinfo.com\/info\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/g33kinfo.com\/info\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/g33kinfo.com\/info\/wp-json\/wp\/v2\/comments?post=6281"}],"version-history":[{"count":0,"href":"https:\/\/g33kinfo.com\/info\/wp-json\/wp\/v2\/posts\/6281\/revisions"}],"wp:attachment":[{"href":"https:\/\/g33kinfo.com\/info\/wp-json\/wp\/v2\/media?parent=6281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/g33kinfo.com\/info\/wp-json\/wp\/v2\/categories?post=6281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/g33kinfo.com\/info\/wp-json\/wp\/v2\/tags?post=6281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}