[cd34]

find -L /var/www -name \*.php -user www-data -print > /var/tmp/webownedphp
awk -F"|"< /var/tmp/webownedphp '{ print "grep -ilE \"\(\(r57|c99\)shell\)|\(passthru|exec|system|eval\)\\\(\" \"" $1 "\""}' | sh > /var/tmp/exploits

somewhat helpful in finding most of the exploits -- or at least weeding the list down quite a bit.