moonwalk is a 400 KB single-binary executable that can clear your traces while penetration testing a Unix machine. It saves the state of system logs pre-exploitation and reverts that state including the filesystem timestamps post-exploitation leaving zero traces of a ghost in the shell.
curl
fetch to your target machine.moonwalk
finds a world-writable path and saves the session under a dot directory which is removed upon ending the session.moonwalk
reverts it back to how it was including the invocation of moonwalk
.GET
command.$ curl -L https://github.com/mufeedvh/moonwalk/releases/download/v1.0.0/moonwalk_linux -o moonwalk
(AMD x86-64
)
OR
Download the executable from Releases OR Install with cargo
:
Prerequisites
$ git clone https://github.com/mufeedvh/moonwalk.git
$ cd moonwalk/
$ cargo build –release
The first command clones this repository into your local machine and the last two commands enters the directory and builds the source in release mode.
Once you get a shell into the target Unix machine, start a moonwalk session by running this command:
$ moonwalk start
While you’re doing recon/exploitation and messing with any files, get the touch
timestamp command of a file beforehand to revert it back after you’ve accessed/modified it:
$ moonwalk get ~/.bash_history
Post-exploitation, clear your traces and close the session with this command:
$ moonwalk finish
shadow-rs is a Windows kernel rootkit written in Rust, demonstrating advanced techniques for kernel manipulation…
Extract and execute a PE embedded within a PNG file using an LNK file. The…
Embark on the journey of becoming a certified Red Team professional with our definitive guide.…
This repository contains proof of concept exploits for CVE-2024-5836 and CVE-2024-6778, which are vulnerabilities within…
This took me like 4 days (+2 days for an update), but I got it…
MaLDAPtive is a framework for LDAP SearchFilter parsing, obfuscation, deobfuscation and detection. Its foundation is…