Usage:
$0 options
Options:
-H help
-I [ip] searches for the top 20 IP addresses in all log files and records in the log files.
-D [ip] Delete IP addresses from log files
-S [fake IP address] spoofed ip address. When it cannot be deleted
-U [user name] delete user records
-W [shell web path] clear access logs of shell pony
-F (not recommended, fuck means, clear all logs)
-E "file extension" search for other backdoors
-R [path] Where to start searching and control the range
For Example:
Ex: $0-h
* To show this help message
Ex: $0-I 192.168.1.7
* To search 192.168.1.7 in all logs files. Basically finding which logs files have trace of it, and
* In addition to that, search all log files (/var/log/*) and show Top 20 most logged IP's in log files.
* They cocould be good choices for spoofing
Ex: $0-d 192.168.1.7-s 10.1.1.7-u "cracker"
* To delete lines containing 192.168.1.7 and | or user_name "cracker" from ASCII files, and
* To spoof 192.168.1.7 in non-ASCII files by 10.1.1.7 and user_name "cracker" by "root"
Ex: $0-d 192.168.1.7-s 10.1.1.7-u "cracker"-w "/var/www/xyz.com/uploads/c99.php"
* To delete lines containing 192.168.1.7 and | or user_name "cracker" and | or web_shell_path from ASCII files, and
* To spoof 192.168.1.7 in non-ASCII files by 10.1.1.7 and user_name "cracker" by "root"
Ex: $0-f
* To erase all log files listed in log_files.sh completely (not recommended)
Ex: $0-e "php txt asp"-r/var/www
* To search for probable web backdoors planted on system. Once found, it is recommended to verify the result
* The current example searches for files having extensions php or txt or asp in/var/www and subdirectories
* Extensions and web_root_directory are customizable
Linux-Log-Eraser (10.5 KiB, 7 hits)
Original article, reprinted Please note: Reprinted from Ps7isys Blog