finding files modified after a certain date

schwim

Hi there everyone,

I've got a server-wide compromise and I need to find the files modified after a certain date. Is there a script out there that someone knows of that can help me find the location of these files and if not, how might I go about finding something like this recursively across directories?

dalecosp

Does the server have a GUI?

I'll guess not ... but most "file manager" tools in GUI's can do something like that.

Script? Unix?

Untested ... YMMV, Use at your own risk, etc.

<?php
//date of "break in"
$date= // set the date here.  Convert to UNIX timestamp.

// system "find"
$all_files = `find / -print`;

$file_list = explode("\n",$all_files);

$changed_list = array();

foreach ($file_list as $file) {
   if (filemtime($file) > $date) {
      $changed_list[]=$file;
   }
}

print_r($changed_list);

dalecosp

Of course, I should mention that there's a good chance that any "cracker" who invaded your box could've changed the file's modification times. 🙁

schwim

Hi there Dale,

Thanks very much for your help. Luckily, it looks like the files are showing the actual modification date.

I'm getting the following error when running the script:

Parse error: syntax error, unexpected T_VARIABLE in /home/schwim/public_html/file_find.php on line 6

 <?php
//date of "break in"
$date=1338508800 // set the date here.  Convert to UNIX timestamp.

// system "find"
$all_files = 'find / -print'; // Line 6( tried changing to single-quotes but the issue remains)

$file_list = explode("\n",$all_files);

$changed_list = array();

foreach ($file_list as $file) {
   if (filemtime($file) > $date) {
      $changed_list[]=$file;
   }
}

print_r($changed_list); 

?>

I'm sorry to continue to bother, but I'm not sure what is incorrect.

Weedpacket

You're misssing a semicolon at the end of the previous (significant) line: [font=monospace]$date=...[/font].

bradgrafelman

schwim;11009269 wrote:
Hi there Dale,

Thanks very much for your help. Luckily, it looks like the files are showing the actual modification date.

Are you sure? How do you know? How do you know all of the modified/new files affected by the compromise are showing up?

Just trying to play the devil's advocate here. IMHO, the first thing to do when you know you'v been compromised is to format and re-install from scratch.

schwim

Hi there guys,

Is there a way to set the script to either consider the placement of the script the root directory or to manually set it? I only need to scan particular directories and their children and this seems to be starting at /.

Thanks a bunch for your time!

dalecosp

That'd be the "/" after "find" and before "-print". If you wanted to, say, only do /usr/local:

$all_files = `find / -print`;

(And, for what it's worth [everything] ... single quotes can't replace the backtick operator.

Here are the instructions for the BSD version of find:

http://www.freebsd.org/cgi/man.cgi?query=find&apropos=0&sektion=0&manpath=FreeBSD+9.0-RELEASE&arch=default&format=html

They might help you change your find options. Probably you're on Linux; there might be differences.

dalecosp

That'd be the "/" after "find" and before "-print". If you wanted to, say, only do /usr/local:

$all_files = `find /usr/local -print`;

(And, for what it's worth [everything] ... single quotes can't replace the backtick operator).

Here are the instructions for the BSD version of find:

http://www.freebsd.org/cgi/man.cgi?query=find&apropos=0&sektion=0&manpath=FreeBSD+9.0-RELEASE&arch=default&format=html

They might help you change your find options. Probably you're on Linux; there might be differences. You should be able to find Linux man pages online as well.

Bonesnap

bradgrafelman;11009291 wrote:
IMHO, the first thing to do when you know you'v been compromised is to format and re-install from scratch.

I usually take the scorched earth approach as well.

"I say we take off and nuke the entire site from orbit. It's the only way to be sure."
- Lt. Ripley,
Aliens