#!/bin/bash
cd /home/
find . -type f \( -iname "1.*" -o -iname "sh.php" \) -print0 >> ../php_backdoors
find . -type f \( -iname "*.php" -o -iname "*.inc" \) -print0 | xargs -0 -r grep -REn \
'(c99|r57|exif_read_data|extract|passthru|shell_exec|base64_decode|fopen|fclose|eval|Refresh|refresh|justrulz)' >> ../php_backdoors