php - How to compare different files from 2 servers with rsync? -
i got trouble hackers, hacked our website, cloned our server new one, , reset github on server.
i heard rsync can find out different 2 servers. possible rsync ? can export list of files text file?
thanks help, got hacked use old version of wordpress >_< crazy last couple days.
the comment marty - rsync command written dry-run (-n
) show files added/deleted/changed between $target
, $source
locations can inspect or diff them see if there malicious code.
additionally, in past when i've dealt hacked wordpress installs, important find exploitation vector. times php shells uploaded via insecure script or plugin gives attacker command based web shell view files , run commands etc.
to find these files, following command helpful:
grep -e '(?:(shell_)?exec|system|eval)' /path/to/wordpress/* -r
this might yield like:
wpte.php: eval($_post['p1']);
which in case, wpte.php
malicious php shell script got uploaded 1 of client's servers used run commands , upload more files. these scripts use 1 or more functions eval
or shell_exec
run commands input web shell.
going there, can check server access logs hits malicious script , further search logs ip address(es) accessed script potentially find how uploaded script or other hits resources accessed.
Comments
Post a Comment