Everybody what comes next video we're going to be talking about clearing command history on Windows
and Linux.
Now what is command history.
So anytime you access the command line whether it's on the windows or on the Linux side you are generating
a history now.
History is just a track whether it's saved to a file database doesn't matter.
It's stored somewhere on the system that shows you what commands have been rammed by what user at what
point in time.
Now luckily for an attacker on the red team's side windows does not have a command history per say it
doesn't save it it saves it in the context of if you have a command line open inside that session you
have your history but if you closed the session it's gone now.
That's great from red team's perspective a bad from a monitoring or a red or blue team perspective because
you're not able to identify what commands are being ran.
However there's other ways such as system monitoring that actually watches commands being ran insist
calls actually occurring that you will not be able to to get by right away.
On the flip side however Linux does keep track of your history.
So this is actually located in.
So if we do so in the home directory you have users.
Correct.
So in this case we have admin and test.
So we'll check admin every user here has something called Dot bash history and that's the file where
the bash history or the command history for you.
That user is set so if we see here we have a batch history and if we go into test flash history we have
got back history as well.
And for root it's in a slightly different location but still its home directory which is bash history
so you can see how easy it is to find out this information.
And this is nothing different than just a text file.
So if we cat out dog bash history on this current machine for our admin or for our route user you'd
see we have clear MSF console we're gripping the history so it's just a simple text file which is no
different than using the history command here.
It's just a pending the the order in which the commands work.
So it goes as it goes down you add more the number gets bigger.
That's the only thing the command history does however for Linux it works slightly differently.
So you can see here if I do let's say history grep history.
Right.
We get our result wouldn't clear this and then I run history just to grab me everything you can see
we have history grep history clear history.
Right.
So to clear this up and we kept our got bash history you can see down here the very bottom it's MSF
console in clear.
Now why is that.
The terminal holds your history in memory first before it touches the file system before the file is
overwritten.
So if we go ahead and clear this if we close out the terminal spawn a new one and then we then we can
out the history file like we did before.
Cat bash the story we can see at the bottom we have everything that we saw before but now we're also
seeing all the commands we ran from the previous console and that this firewall if more than one user
is logged in his route they'll all set in memory and then as they closed the terminals it'll go ahead
and write to this file.
Now when should you clear this.
You should treat this similar to a log file and insert it in a special sense it is a log file you only
want to clear the commands that you actively created if you want to be stealthy if you don't then that's
fine you can leave them you can leave them in there but when you leave commands in there especially
if your finding new different ways to escalate privileges new attack vectors new exploit techniques
anything like that that you're trying to do that bypasses things or that's not normally Public Knowledge
leaving your command history is a good way to have somebody quickly identify what you did and then get
the patch in or the vulnerability into the vendor to get it fixed.
So if you want to keep things hidden such as we've had issues where for example people would upload
things to Virus Total and it actually was a new exploit since Virus Total caught it.
They looked at it and found out that it was new malware which is really funny to find that people were
testing out their new exploits while leaking the exploit.
So the same thing can be said for the command history if you're doing something sneaky with command
history or commands in general to bypass things such as using question marks or anything like that to
try to bypass what you can and you find a new way to do it if you leave it in the history then somebody
is going to know how you did it or at least be able to start investigating on how you did it but there
is going to be some times where you might want to do something some action on every user's history file
whether it's just grabbing it looking for passwords et cetera.
So to do this we can use the fine statements.
So if we do find slash home Josh max depth is too so we only want to go one directory deep essentially
it's the first directory because we have dot bashed history there so this is the first depth and then
the user name is the next it'll do.
Gosh I name and we're going to look for dot dash straight game mind you can only do this as routes type
file because we're going into users home directories so that we're going to exact some what do we want
to execute we want to let's say we want to go out the file name so we know which one we're referring
to.
So if we echo here so these parentheses are are these curly brackets are for referencing this path.
So the home slash whatever the user name is got back history.
That's what this gets replaced with.
So just keep that in mind when working with find then we wanna kill that off and we will just do we'll
grab Dash I for ignoring the case and we'll look at a password or pass anything with the That's uppercase
lowercase with pass in the line we're going to go ahead and grab it remember gripping out that file.
So we're going to do that.
We're looking at that file and we'll give ourselves some space and that's it.
So if you go ahead run this boat we can see home tests dot batch history we have somebody echoed password
into password that texting and then in admin batch history we have passed a BD admin.
So somebody tried to change the admin password.
Unfortunately it's not going to tell you the time that this type of stuff occurred.
But just keep that in mind.
So to clear it you can do just clear the whole file directly echo nothing into it if you really wanted
to.
However if we wanted to clear just this guy from temp tests let's say so we can do VDI OK said whatever
you want to do anything that can modify text in a dock in a file you can run with this.
So home test batch history.
So this in this case this user only has the one thing what if we go ahead and clear that out and save
the file and then rerun our find we don't see anything so that's how we clear it up.
But keep in mind if the users logged in and they run something then they closed the prompt it will get
overwritten by what you just did.
But what you've removed will still be removed so keep that in mind.
But what I want you guys to do is a little extra assignment here.
I want you to test this out on your own system double check see if you see the same issue where if you're
having the console open and you clear out the history file completely then you close your terminal.
What happens what happens when you have the file open in VDI and a different editor and then you clear
it out and then close the prompt again.
So play around with it understand how the bash history file is written and overwrite it.