Hacking Tutorials VI

  Cleaning up
  ~~~~~~~~~~~

Remember when we logedin to target.edu as luser, and used su to become root?
Take a look to this line:

  Last login: Fry Sep 22 20:47:59 from xx.xx.xx.xx.

Yes, that was displayed by the target box when we logedin there.
It refers to the last login that the real luser did.

So, what will be displayed when luser logsin again?

  Last login: Sun Sep 24 10:32:14 from .

Then luser writes a mail to the admin:

"It has happen some strange thing, when I loggedin today, I've read a line like this:

 Last login: Sun Sep 24 10:32:14 from .

 Does it mean I did login yesterday? It can't be, I don't work on sundays!
 I think it's a bug and this is your fault."

The admin responds to luser:

"That wasn't a bug! this line means someone acceded the system using your password, don't
 worry for that, we got his IP. That means we can ask his ISP what phone number did call
 at 10:32 and get . Then we shall call the police and he'll get busted"

So you'll get busted because luser was a bit clever (sometimes happens).

So we gotta find a way to delete that.

This information can be stored in: 
 
/usr/adm/lastlog 
/var/adm/lastlog 
/var/log/lastlog

and we can erase it using lled (get it from my site) 

lled gots a buitin help that explains how to use it, remember to chmod the fake file
created by lled like the substitute lastlog file.

There is also some information we'd like to erase:

Remember when i told you not to use FTP? Well, in case you did it, you must now 
use wted to clean up. Its sintax is very similar to lled.
you can get it from my site.


The who command shows us (and the admin) which lusers are logedin at the moment.
What if we login and the admin is there?

 sh-2.03$ who
 root tty1 Sep 25 18:18 

Then we shall use zap2. If you loggedin as 'luser', then type:

 sh-2.03$ ./zap2 luser
 Zap2!
 sh-2.03$ who
 sh-2.03$

And luser has never been here.

  Greetings
  ~~~~~~~~~

Ok, this is all for now (i'll make a newer version). I hope it has been useful to you and you 
decide to continue learning and become a real hacker. You can visit my site (www.3b0x.com)
for more advanced tutorials so you can improve your skills.

I'd get very happy if you send me a mail telling me your impression about this paper (wether
is good or bad), and you help me to improve it.

I'd like to send my greetings to every hacker that has tought me in any way, through newsgroups
or other tutorials like this one. thanks to all.