Without much background other than some sample code we have taken from another script, we have created a useful tool to help us cover up our actions. Clearing the file replication service Event LogĪnd the only event left in the log on the system is the expected 517. Clearing the directory service Event Log TYpe wevtutil cl + the name of the log you want to delete and press Enter to remove the log file. Type wevtutil el and press Enter to list all the logs. Meterpreter session 1 opened (172.16.104.130:4444 -> 172.16.104.145:1253)Ĭlearing Event Logs, this will leave an event 517 Also run Command Prompt as administrator. Transmitting intermediate stager for over-sized stage.(191 bytes) Trying target Windows 2000 SP0-SP4 English. Then, let’s re-exploit the system and see if it works. Print_line("All Clear! You are a Ninja!")Īfter writing our script, we place it in /usr/share/metasploit-framework/scripts/meterpreter/. Print_status("\tClearing the # Event Log") Print_status("Clearing Event Logs, this will leave and event 517") Looking at the source for the winenum script, located in scripts/meterpreter, we can see the way this function works. Data Windows uses to open commonly used programs faster. C:\Windows C:\Windows > Debug Normally it’s safe to delete all files and folders in this location: C:\Windows > Logs Old Prefetch Data. Likely safe locations to delete ONLY FILES THAT END IN. Whatever the reason, you may find a circumstance where you need to clear away the windows event logs. Files that store data about what certain applications did. Important parts of the fixlet: createfile until offįor /f %%A in ('dir c:\windows\temp\cab_*^| find "File(s)"') do set cnt=%%Aįorfiles /P "c:\windows\temp" /S /M *.Sometimes it’s best to not have your activities logged.
If there is a better way to do this I’d be interested. We’re checking for more than 100 cab_ files to see if the problem condition exists then making sure to only delete the oldest cbs log file (supposed to be the problem one) and log files older than 30 days in c:\windows\temp. I might could have just posted the actual cmd file earlier.
0 kommentar(er)
