Find base64 inside PHP files, may indicate a hack, usually involving WordPress

find-wp-hacks.php

#!/bin/bash
# Script by Kris Chase ( [email protected] )
# http://krischase.com
# Source: http://krischase.com/how-to-find-and-clean-up-infected-wordpress-files-over-ssh/
#
# Modified by Tyler Longren to include  ( [email protected] )
# https://longren.io
# Neither of us are responsible for any damage that may occur when running this script.

LIST=infectedfiles.txt
PATTERN="eval(base64_decode"
TARGET="/home/youruser"

if [ ! -s $LIST ] ; then
grep -l -R --include=*.php $PATTERN $TARGET > $LIST
fi

for INPUT in `cat $LIST`
do
echo FIX $INPUT ...
TEMP=$INPUT.tmp
OLD=$INPUT.bad
< $INPUT sed "s/<?php/\n<?php/g" | grep -v $PATT > $TEMP
mv $INPUT $OLD
mv $TEMP $INPUT
done