我的服务器上某处安装了一个恶意 php,我想将其删除并坚持使用纯 yum 安装。
我如何查找并卸载这个恶意 php 安装?
yum 和 rpm 搜索均无结果。
$ yum list installed | grep -i php
$ rpm -qa | grep -i php
$ php -v
-bash: /usr/bin/php: No such file or directory
但浏览器可以返回一个简单的<?php phpinfo(); ?>
页面。
答案1
可能只安装了 apache php 模块,而没有安装命令行解释器。您可以通过不在 httpd.conf(或配置包含)中加载该模块来禁用它。
从包安装的替代方法是复制二进制文件或从源代码进行编译。
如果运气好的话,源代码还可以保留下来,您可以尝试一下 Makefile 文件是否有卸载部分并且make uninstall
可以工作。
如果没有,那么手动删除是删除该软件的唯一方法。makefile 可能包含一些有关组件安装位置的提示。
答案2
这对我有用:
$ find / -name php -type f -executable 2>/dev/null
/usr/bin/php
(运行时可能需要喝点咖啡)。
答案3
这是我在服务器上安装的所有软件包:
rpm -aq | grep php
php-common-5.3.3-23.el6_4.x86_64
php-mysql-5.3.3-23.el6_4.x86_64
php-pdo-5.3.3-23.el6_4.x86_64
php-cli-5.3.3-23.el6_4.x86_64
php-5.3.3-23.el6_4.x86_64
系统中已安装所有文件。尝试查找。
参见 /etc/httpd/modules
库php5.so
rpm -ql php-common-5.3.3-23.el6_4.x86_64
/etc/php.d
/etc/php.d/curl.ini
/etc/php.d/fileinfo.ini
/etc/php.d/json.ini
/etc/php.d/phar.ini
/etc/php.d/zip.ini
/etc/php.ini
/usr/lib64/php
/usr/lib64/php/modules
/usr/lib64/php/modules/curl.so
/usr/lib64/php/modules/fileinfo.so
/usr/lib64/php/modules/json.so
/usr/lib64/php/modules/phar.so
/usr/lib64/php/modules/zip.so
/usr/lib64/php/pear
/usr/share/doc/php-common-5.3.3
/usr/share/doc/php-common-5.3.3/CODING_STANDARDS
/usr/share/doc/php-common-5.3.3/CREDITS
/usr/share/doc/php-common-5.3.3/EXTENSIONS
/usr/share/doc/php-common-5.3.3/INSTALL
/usr/share/doc/php-common-5.3.3/LICENSE
/usr/share/doc/php-common-5.3.3/NEWS
/usr/share/doc/php-common-5.3.3/README.EXTENSIONS
/usr/share/doc/php-common-5.3.3/README.EXT_SKEL
/usr/share/doc/php-common-5.3.3/README.MAILINGLIST_RULES
/usr/share/doc/php-common-5.3.3/README.PARAMETER_PARSING_API
/usr/share/doc/php-common-5.3.3/README.PHP4-TO-PHP5-THIN-CHANGES
/usr/share/doc/php-common-5.3.3/README.REDIST.BINS
/usr/share/doc/php-common-5.3.3/README.RELEASE_PROCESS
/usr/share/doc/php-common-5.3.3/README.SELF-CONTAINED-EXTENSIONS
/usr/share/doc/php-common-5.3.3/README.STREAMS
/usr/share/doc/php-common-5.3.3/README.SUBMITTING_PATCH
/usr/share/doc/php-common-5.3.3/README.SVN-RULES
/usr/share/doc/php-common-5.3.3/README.TESTING
/usr/share/doc/php-common-5.3.3/README.TESTING2
/usr/share/doc/php-common-5.3.3/README.UNIX-BUILD-SYSTEM
/usr/share/doc/php-common-5.3.3/README.WIN32-BUILD-SYSTEM
/usr/share/doc/php-common-5.3.3/README.input_filter
/usr/share/doc/php-common-5.3.3/README.namespaces
/usr/share/doc/php-common-5.3.3/TSRM_LICENSE
/usr/share/doc/php-common-5.3.3/ZEND_CHANGES
/usr/share/doc/php-common-5.3.3/ZEND_LICENSE
/usr/share/doc/php-common-5.3.3/php.ini-development
/usr/share/doc/php-common-5.3.3/php.ini-production
/usr/share/doc/php-common-5.3.3/regex_COPYRIGHT
/usr/share/php
/var/lib/php
rpm -ql php-common-5.3.3-23.el6_4.x86_64
/etc/php.d
/etc/php.d/curl.ini
/etc/php.d/fileinfo.ini
/etc/php.d/json.ini
/etc/php.d/phar.ini
/etc/php.d/zip.ini
/etc/php.ini
/usr/lib64/php
/usr/lib64/php/modules
/usr/lib64/php/modules/curl.so
/usr/lib64/php/modules/fileinfo.so
/usr/lib64/php/modules/json.so
/usr/lib64/php/modules/phar.so
/usr/lib64/php/modules/zip.so
/usr/lib64/php/pear
/usr/share/doc/php-common-5.3.3
/usr/share/doc/php-common-5.3.3/CODING_STANDARDS
/usr/share/doc/php-common-5.3.3/CREDITS
/usr/share/doc/php-common-5.3.3/EXTENSIONS
/usr/share/doc/php-common-5.3.3/INSTALL
/usr/share/doc/php-common-5.3.3/LICENSE
/usr/share/doc/php-common-5.3.3/NEWS
/usr/share/doc/php-common-5.3.3/README.EXTENSIONS
/usr/share/doc/php-common-5.3.3/README.EXT_SKEL
/usr/share/doc/php-common-5.3.3/README.MAILINGLIST_RULES
/usr/share/doc/php-common-5.3.3/README.PARAMETER_PARSING_API
/usr/share/doc/php-common-5.3.3/README.PHP4-TO-PHP5-THIN-CHANGES
/usr/share/doc/php-common-5.3.3/README.REDIST.BINS
/usr/share/doc/php-common-5.3.3/README.RELEASE_PROCESS
/usr/share/doc/php-common-5.3.3/README.SELF-CONTAINED-EXTENSIONS
/usr/share/doc/php-common-5.3.3/README.STREAMS
/usr/share/doc/php-common-5.3.3/README.SUBMITTING_PATCH
/usr/share/doc/php-common-5.3.3/README.SVN-RULES
/usr/share/doc/php-common-5.3.3/README.TESTING
/usr/share/doc/php-common-5.3.3/README.TESTING2
/usr/share/doc/php-common-5.3.3/README.UNIX-BUILD-SYSTEM
/usr/share/doc/php-common-5.3.3/README.WIN32-BUILD-SYSTEM
/usr/share/doc/php-common-5.3.3/README.input_filter
/usr/share/doc/php-common-5.3.3/README.namespaces
/usr/share/doc/php-common-5.3.3/TSRM_LICENSE
/usr/share/doc/php-common-5.3.3/ZEND_CHANGES
/usr/share/doc/php-common-5.3.3/ZEND_LICENSE
/usr/share/doc/php-common-5.3.3/php.ini-development
/usr/share/doc/php-common-5.3.3/php.ini-production
/usr/share/doc/php-common-5.3.3/regex_COPYRIGHT
/usr/share/php
/var/lib/php
rpm -ql php-5.3.3-23.el6_4.x86_64
/etc/httpd/conf.d/php.conf
/usr/lib64/httpd/modules/libphp5.so
/var/lib/php/session
/var/www/icons/php.gif