|
| 1 | +<!DOCTYPE html> |
| 2 | +<html lang="en"> |
| 3 | +<head> |
| 4 | +<meta charset="UTF-8"> |
| 5 | +<meta name="viewport" content="width=device-width, initial-scale=1.0"> |
| 6 | +<title>hidemylogs</title> |
| 7 | +<style> |
| 8 | +*,*::before,*::after{box-sizing:border-box;margin:0;padding:0} |
| 9 | +:root{ |
| 10 | + --bg:#0a0a0a;--green:#00ff41;--green-dim:rgba(0,255,65,.08);--green-glow:rgba(0,255,65,.15); |
| 11 | + --amber:#ffb000;--red:#ff3333;--dim:#1a3a1a;--text:#00cc33;--muted:#006611; |
| 12 | + --mono:'Courier New',Courier,monospace; |
| 13 | +} |
| 14 | +html,body{height:100%;background:var(--bg);color:var(--green);font-family:var(--mono);overflow-x:hidden} |
| 15 | + |
| 16 | +/* CRT effect */ |
| 17 | +body::before{content:'';position:fixed;inset:0;pointer-events:none;z-index:9999; |
| 18 | + background:repeating-linear-gradient(0deg,transparent,transparent 2px,rgba(0,0,0,.15) 2px,rgba(0,0,0,.15) 4px)} |
| 19 | +body::after{content:'';position:fixed;inset:0;pointer-events:none;z-index:9998; |
| 20 | + background:radial-gradient(ellipse at center,transparent 50%,rgba(0,0,0,.4) 100%); |
| 21 | + animation:flicker 0.15s infinite} |
| 22 | +@keyframes flicker{0%{opacity:.97}50%{opacity:1}100%{opacity:.98}} |
| 23 | + |
| 24 | +.wrap{max-width:900px;margin:0 auto;padding:1.5rem;min-height:100vh;position:relative;z-index:1} |
| 25 | + |
| 26 | +/* Boot sequence */ |
| 27 | +.boot{font-size:.75rem;color:var(--muted);margin-bottom:2rem;line-height:1.8} |
| 28 | +.boot span{display:block;opacity:0;animation:boot-in .3s forwards} |
| 29 | +.boot span:nth-child(1){animation-delay:.2s} |
| 30 | +.boot span:nth-child(2){animation-delay:.5s} |
| 31 | +.boot span:nth-child(3){animation-delay:.8s} |
| 32 | +.boot span:nth-child(4){animation-delay:1.1s} |
| 33 | +.boot span:nth-child(5){animation-delay:1.4s} |
| 34 | +.boot span:nth-child(6){animation-delay:1.7s;color:var(--green)} |
| 35 | +@keyframes boot-in{to{opacity:1}} |
| 36 | + |
| 37 | +/* Header */ |
| 38 | +.header{margin:1.5rem 0 2rem;opacity:0;animation:boot-in .5s forwards 2s} |
| 39 | +.ascii{font-size:.7rem;line-height:1.2;color:var(--green);white-space:pre;text-shadow:0 0 8px var(--green-glow)} |
| 40 | +.tagline{color:var(--muted);font-size:.7rem;margin-top:.8rem;letter-spacing:.1em} |
| 41 | + |
| 42 | +/* Mission briefing */ |
| 43 | +.section{margin:2.5rem 0;opacity:0;animation:boot-in .5s forwards} |
| 44 | +.section:nth-of-type(1){animation-delay:2.3s} |
| 45 | +.section:nth-of-type(2){animation-delay:2.6s} |
| 46 | +.section:nth-of-type(3){animation-delay:2.9s} |
| 47 | +.section:nth-of-type(4){animation-delay:3.2s} |
| 48 | +.section:nth-of-type(5){animation-delay:3.5s} |
| 49 | +.section:nth-of-type(6){animation-delay:3.8s} |
| 50 | + |
| 51 | +.section-head{font-size:.65rem;letter-spacing:.2em;text-transform:uppercase;color:var(--amber);margin-bottom:.8rem} |
| 52 | +.section-head::before{content:'[';color:var(--muted)}.section-head::after{content:']';color:var(--muted)} |
| 53 | + |
| 54 | +/* Live terminal */ |
| 55 | +.term{background:#050505;border:1px solid var(--dim);border-radius:0;padding:0;margin:1rem 0;overflow:hidden; |
| 56 | + box-shadow:0 0 20px rgba(0,255,65,.05)} |
| 57 | +.term-bar{background:#0d0d0d;padding:.4rem .8rem;display:flex;align-items:center;gap:.4rem;border-bottom:1px solid var(--dim)} |
| 58 | +.term-dot{width:8px;height:8px;border-radius:50%} |
| 59 | +.term-dot.r{background:#441111}.term-dot.y{background:#332200}.term-dot.g{background:#003311} |
| 60 | +.term:hover .term-dot.r{background:#ff3333}.term:hover .term-dot.y{background:var(--amber)}.term:hover .term-dot.g{background:var(--green)} |
| 61 | +.term-title{font-size:.55rem;color:var(--muted);margin-left:.5rem;letter-spacing:.1em} |
| 62 | +.term-body{padding:1rem;font-size:.78rem;line-height:1.7;white-space:pre;overflow-x:auto;min-height:100px} |
| 63 | +.term-body .prompt{color:var(--red);user-select:none} |
| 64 | +.term-body .cmd{color:var(--green)} |
| 65 | +.term-body .flag{color:var(--amber)} |
| 66 | +.term-body .out{color:var(--muted)} |
| 67 | +.term-body .ok{color:var(--green)} |
| 68 | +.term-body .warn{color:var(--amber)} |
| 69 | +.term-body .bad{color:var(--red)} |
| 70 | + |
| 71 | +/* Typing animation */ |
| 72 | +.type-line{overflow:hidden;white-space:nowrap;border-right:2px solid var(--green); |
| 73 | + width:0;animation:typing 1.5s steps(40) forwards,blink-caret .75s step-end infinite} |
| 74 | +@keyframes typing{from{width:0}to{width:100%;border-right-color:transparent}} |
| 75 | +@keyframes blink-caret{50%{border-color:transparent}} |
| 76 | + |
| 77 | +/* Data table */ |
| 78 | +.data-tbl{width:100%;font-size:.72rem;border-collapse:collapse;margin:.8rem 0} |
| 79 | +.data-tbl th{text-align:left;color:var(--amber);padding:.3rem .6rem;border-bottom:1px solid var(--dim); |
| 80 | + font-size:.6rem;letter-spacing:.12em;text-transform:uppercase} |
| 81 | +.data-tbl td{padding:.3rem .6rem;border-bottom:1px solid #0d1a0d;color:var(--text)} |
| 82 | +.data-tbl tr:hover td{background:var(--green-dim)} |
| 83 | + |
| 84 | +/* Target cards */ |
| 85 | +.targets{display:grid;grid-template-columns:repeat(auto-fit,minmax(250px,1fr));gap:.8rem;margin:1rem 0} |
| 86 | +.target{border:1px solid var(--dim);padding:.8rem;transition:border-color .2s,box-shadow .2s} |
| 87 | +.target:hover{border-color:var(--green);box-shadow:0 0 12px var(--green-glow)} |
| 88 | +.target h3{font-size:.65rem;letter-spacing:.1em;color:var(--amber);margin-bottom:.4rem} |
| 89 | +.target p{font-size:.68rem;color:var(--muted);line-height:1.5} |
| 90 | +.target code{color:var(--green);font-size:.65rem} |
| 91 | + |
| 92 | +/* Links */ |
| 93 | +.links{display:flex;gap:1rem;flex-wrap:wrap;margin-top:2rem;opacity:0;animation:boot-in .5s forwards 4.1s} |
| 94 | +.lnk{font-size:.65rem;letter-spacing:.12em;text-transform:uppercase;color:var(--muted);text-decoration:none; |
| 95 | + border:1px solid var(--dim);padding:.4rem 1rem;transition:all .15s} |
| 96 | +.lnk:hover{color:var(--green);border-color:var(--green);box-shadow:0 0 8px var(--green-glow)} |
| 97 | + |
| 98 | +/* Status bar */ |
| 99 | +.status{position:fixed;bottom:0;left:0;right:0;background:#050505;border-top:1px solid var(--dim); |
| 100 | + padding:.3rem 1rem;font-size:.55rem;color:var(--muted);display:flex;justify-content:space-between;z-index:10} |
| 101 | +.status .live{color:var(--green);animation:blink-status 2s infinite} |
| 102 | +@keyframes blink-status{0%,100%{opacity:1}50%{opacity:.3}} |
| 103 | + |
| 104 | +@media(max-width:600px){.wrap{padding:1rem}.term-body{font-size:.68rem;padding:.8rem}.ascii{font-size:.5rem}} |
| 105 | +</style> |
| 106 | +</head> |
| 107 | +<body> |
| 108 | + |
| 109 | +<div class="wrap"> |
| 110 | + |
| 111 | +<!-- Boot sequence --> |
| 112 | +<div class="boot"> |
| 113 | + <span>BIOS POST... OK</span> |
| 114 | + <span>Loading kernel modules... [utmp] [wtmp] [btmp] [lastlog]</span> |
| 115 | + <span>Initializing struct parsers... 384B utmp / 292B lastlog</span> |
| 116 | + <span>Checking target permissions... requires root or CAP_DAC_OVERRIDE</span> |
| 117 | + <span>Disabling auditd trace... compiled binary, single execve</span> |
| 118 | + <span>[READY] hidemylogs v1.0.0 - surgical log cleaner</span> |
| 119 | +</div> |
| 120 | + |
| 121 | +<!-- ASCII header --> |
| 122 | +<div class="header"> |
| 123 | +<pre class="ascii"> _ _ _ _ |
| 124 | +| |__ (_) __| | ___ _ __ ___ _ _| | ___ __ _ ___ |
| 125 | +| '_ \| |/ _` |/ _ \ '_ ` _ \| | | | |/ _ \ / _` / __| |
| 126 | +| | | | | (_| | __/ | | | | | |_| | | (_) | (_| \__ \ |
| 127 | +|_| |_|_|\__,_|\___|_| |_| |_|\__, |_|\___/ \__, |___/ |
| 128 | + |___/ |___/</pre> |
| 129 | +<div class="tagline">post-exploitation log cleaner // rust // zero dependencies // preserve metadata</div> |
| 130 | +</div> |
| 131 | + |
| 132 | +<!-- Mission: Recon --> |
| 133 | +<div class="section"> |
| 134 | + <div class="section-head">recon - read target logs</div> |
| 135 | + <div class="term"> |
| 136 | + <div class="term-bar"><span class="term-dot r"></span><span class="term-dot y"></span><span class="term-dot g"></span><span class="term-title">operator@c2 - recon</span></div> |
| 137 | + <div class="term-body"><span class="prompt">root@target:~# </span><span class="cmd">./hidemylogs print -s uwbl</span> |
| 138 | + |
| 139 | +<span class="out">=== wtmp ===</span> |
| 140 | +<span class="out">admin pts/2 10.0.1.101 2026-03-27 14:22 LOGIN 12001</span> |
| 141 | +<span class="out">dev pts/3 10.0.1.102 2026-03-26 08:45 LOGIN 12050</span> |
| 142 | +<span class="bad">root pts/0 185.220.101.34 2026-03-28 03:47 LOGIN 31337</span> <span class="warn"><-- you are here</span> |
| 143 | +<span class="out">svc_bak pts/6 45.153.160.140 2026-03-28 03:52 LOGIN 31338</span> |
| 144 | +<span class="out">implant pts/7 185.220.101.34 2026-03-28 04:01 LOGIN 31339</span> |
| 145 | + |
| 146 | +<span class="out">=== btmp ===</span> |
| 147 | +<span class="bad">root ssh 185.220.101.34 2026-03-28 03:41 x7 attempts</span> |
| 148 | +<span class="bad">admin ssh 185.220.101.34 2026-03-28 03:43 x2 attempts</span> |
| 149 | + |
| 150 | +<span class="out">=== lastlog ===</span> |
| 151 | +<span class="bad">UID 0 pts/0 185.220.101.34 2026-03-28 03:47</span></div> |
| 152 | + </div> |
| 153 | +</div> |
| 154 | + |
| 155 | +<!-- Mission: Clean --> |
| 156 | +<div class="section"> |
| 157 | + <div class="section-head">clean - erase your tracks</div> |
| 158 | + <div class="term"> |
| 159 | + <div class="term-bar"><span class="term-dot r"></span><span class="term-dot y"></span><span class="term-dot g"></span><span class="term-title">operator@c2 - wipe</span></div> |
| 160 | + <div class="term-body"><span class="prompt">root@target:~# </span><span class="cmd">./hidemylogs wipe <span class="flag">-a</span> 185.220.101.34 <span class="flag">-s</span> uwb <span class="flag">--dry-run</span></span> |
| 161 | + |
| 162 | +<span class="warn">[DRY RUN] No files will be modified.</span> |
| 163 | + <span class="warn">[DRY]</span> Would wipe: root pts/0 185.220.101.34 03:47 |
| 164 | + <span class="warn">[DRY]</span> Would wipe: implant pts/7 185.220.101.34 04:01 |
| 165 | + <span class="warn">[DRY]</span> Would wipe: root ssh:notty 185.220.101.34 03:41 (x3 btmp) |
| 166 | + <span class="warn">[DRY]</span> Would wipe: admin ssh:notty 185.220.101.34 03:43 (x2 btmp) |
| 167 | +<span class="ok">[+] 7 record(s) would be wiped</span> |
| 168 | + |
| 169 | +<span class="prompt">root@target:~# </span><span class="cmd">./hidemylogs wipe <span class="flag">-a</span> 185.220.101.34 <span class="flag">-s</span> uwb</span> |
| 170 | +<span class="ok">[+] 5 record(s) wiped from wtmp</span> |
| 171 | +<span class="ok">[+] 2 record(s) wiped from btmp</span> |
| 172 | +<span class="ok">[*] Total: 7 record(s) wiped</span></div> |
| 173 | + </div> |
| 174 | +</div> |
| 175 | + |
| 176 | +<!-- Mission: Forge --> |
| 177 | +<div class="section"> |
| 178 | + <div class="section-head">forge - plant false evidence</div> |
| 179 | + <div class="term"> |
| 180 | + <div class="term-bar"><span class="term-dot r"></span><span class="term-dot y"></span><span class="term-dot g"></span><span class="term-title">operator@c2 - forge</span></div> |
| 181 | + <div class="term-body"><span class="prompt">root@target:~# </span><span class="cmd">./hidemylogs forge <span class="flag">--uid</span> 0 <span class="flag">-t</span> "2026-03-15 09:30:00" <span class="flag">--line</span> pts/0 <span class="flag">--host</span> 10.0.1.50</span> |
| 182 | +<span class="ok">[+] Forged lastlog for UID 0: pts/0 from 10.0.1.50 at 2026-03-15 09:30:00</span> |
| 183 | + |
| 184 | +<span class="out">Before: root last login from 185.220.101.34 at 03:47 (Tor exit node)</span> |
| 185 | +<span class="ok">After: root last login from 10.0.1.50 at 09:30 (internal admin IP)</span></div> |
| 186 | + </div> |
| 187 | +</div> |
| 188 | + |
| 189 | +<!-- Mission: Verify --> |
| 190 | +<div class="section"> |
| 191 | + <div class="section-head">verify - confirm clean state</div> |
| 192 | + <div class="term"> |
| 193 | + <div class="term-bar"><span class="term-dot r"></span><span class="term-dot y"></span><span class="term-dot g"></span><span class="term-title">operator@c2 - verify</span></div> |
| 194 | + <div class="term-body"><span class="prompt">root@target:~# </span><span class="cmd">last | head -5</span> |
| 195 | +<span class="ok">admin pts/2 10.0.1.101 Thu Mar 27 14:22 still logged in</span> |
| 196 | +<span class="ok">dev pts/3 10.0.1.102 Wed Mar 26 08:45 - 12:30 (03:45)</span> |
| 197 | +<span class="out"> <-- no trace of 185.220.101.34</span> |
| 198 | + |
| 199 | +<span class="prompt">root@target:~# </span><span class="cmd">lastlog | grep root</span> |
| 200 | +<span class="ok">root pts/0 10.0.1.50 Sat Mar 15 09:30:00 2026</span> |
| 201 | +<span class="out"> <-- forged, looks normal</span> |
| 202 | + |
| 203 | +<span class="prompt">root@target:~# </span><span class="cmd">lastb | head</span> |
| 204 | +<span class="ok">btmp begins Thu Mar 27 00:00:00 2026</span> |
| 205 | +<span class="out"> <-- brute force attempts gone</span></div> |
| 206 | + </div> |
| 207 | +</div> |
| 208 | + |
| 209 | +<!-- Targets --> |
| 210 | +<div class="section"> |
| 211 | + <div class="section-head">supported targets</div> |
| 212 | + <div class="targets"> |
| 213 | + <div class="target"><h3>utmp</h3><p>Current sessions. Read by <code>who</code>, <code>w</code>.</p></div> |
| 214 | + <div class="target"><h3>wtmp</h3><p>Login/logout history. Read by <code>last</code>.</p></div> |
| 215 | + <div class="target"><h3>btmp</h3><p>Failed login attempts. Read by <code>lastb</code>.</p></div> |
| 216 | + <div class="target"><h3>lastlog</h3><p>Last login per UID. Read by <code>lastlog</code>. Supports wipe + forge.</p></div> |
| 217 | + </div> |
| 218 | +</div> |
| 219 | + |
| 220 | +<!-- OPSEC --> |
| 221 | +<div class="section"> |
| 222 | + <div class="section-head">opsec notes</div> |
| 223 | + <table class="data-tbl"> |
| 224 | + <thead><tr><th>Vector</th><th>Shell script</th><th>hidemylogs (binary)</th></tr></thead> |
| 225 | + <tbody> |
| 226 | + <tr><td>.bash_history</td><td style="color:var(--red)">Every command logged</td><td style="color:var(--green)">Single execve</td></tr> |
| 227 | + <tr><td>auditd</td><td style="color:var(--red)">Multiple syscalls per op</td><td style="color:var(--green)">Direct read/write/lseek</td></tr> |
| 228 | + <tr><td>ps / proc</td><td style="color:var(--red)">Interpreter visible</td><td style="color:var(--green)">Binary name only</td></tr> |
| 229 | + <tr><td>Disk artifacts</td><td style="color:var(--red)">.py/.sh persists</td><td style="color:var(--green)">Run from /dev/shm, delete</td></tr> |
| 230 | + <tr><td>Dependencies</td><td style="color:var(--red)">Python/Bash required</td><td style="color:var(--green)">musl static, zero deps</td></tr> |
| 231 | + <tr><td>File timestamps</td><td style="color:var(--red)">mtime changes</td><td style="color:var(--green)">atime+mtime restored</td></tr> |
| 232 | + </tbody> |
| 233 | + </table> |
| 234 | +</div> |
| 235 | + |
| 236 | +<div class="links"> |
| 237 | + <a class="lnk" href="https://github.com/franckferman/hidemylogs/releases">Download</a> |
| 238 | + <a class="lnk" href="https://github.com/franckferman/hidemylogs">Source</a> |
| 239 | + <a class="lnk" href="https://github.com/franckferman/hidemylogs#readme">Docs</a> |
| 240 | + <a class="lnk" href="https://github.com/franckferman/LastLog-Audit">Detection</a> |
| 241 | +</div> |
| 242 | + |
| 243 | +</div> |
| 244 | + |
| 245 | +<div class="status"> |
| 246 | + <span><span class="live">●</span> hidemylogs v1.0.0</span> |
| 247 | + <span>T1070.002 / T1070.006 / T1070.003</span> |
| 248 | + <span>franckferman</span> |
| 249 | +</div> |
| 250 | + |
| 251 | +</body> |
| 252 | +</html> |
0 commit comments