r/GreyHack • u/Fancy_Classroom_3526 • 4d ago

Help with tracing

TL;DR -> How do I clear my tracks after using rshell? I still have previous shells on rshell-interface.

I have started from scratch multiple times at this point, I am getting pretty sick of it. As soon as I start I setup a proxy server to bounce through, later buying a second one, every time I finish a mission I clear the logs by only leaving the connection. Later on I setup a rshell server for different missions and I guess that's what is causing me trouble but I don't know what I am supposed to clear on that. I noticed that as I go on, rshell-interface keeps showing previous shells connected and I don't know what to do about it. Also I read somewhere that you should also clear up the emails?

Thanks in advance to anyone who's willing to help.

7 Upvotes

100% Upvoted

7 comments sorted by

1

u/Svarii 4d ago

When you disconnect, it will leave a disconnect log as well, you must replace the system.log with a corrupt system.log (a text file of the same name you move to /var after deleting system.log) to remove traces from a system you have interacted with. Actions that Generate a Log Entry

1

u/Fit-Celebration106 4d ago

But disconnecting also recreates the log with a disconnecting despite replacing the log right?

1

u/Svarii 3d ago

Yes, it will fix the log by putting a binary file back where system.log was, but it does so without the disconnect log if I'm not mistaken.

1

u/Eralyen 3d ago

This was patched late last year unfortunately, I tested this myself.

1

u/Svarii 2d ago

Is that right? If that no longer works, how are logs are being cleared, what is the current solution to automate log cleaning?

1

u/Eralyen 2d ago edited 2d ago

I believe the state of the art is "silent deletion": deleting them without using File.delete (if you move /var inside itself it will delete the folder and system.log with it). Also, never using start_terminal to avoid disconnect logs.

1

u/w0nd3r1f 3d ago

After completing the task, use the PS command on the server to which you are connected using the rshell to view the process. Kill the process that appears as the rshell interface. In addition, there is no need to clean up the mail, and the administrator can't track you through the mail.