mufeedvh/moonwalk

mufeedvh/moonwalk has 1,491 GitHub stars and 134 forks. GitHot measured 0 stars in 24 hours, -1 in 7 days, and 0 in 15 days. Last checked 2026-11-13 06:59 UTC. Last push 2022-10-08.

この数値の測り方

1,491 スター 134 フォーク

できること

Small Executable: Get started quickly with a curl fetch to your target machine.
Fast: Performs all session commands including logging, trace clearing, and filesystem operations in under 5 milliseconds.
Reconnaissance: To save the state of system logs, moonwalk finds a world-writable path and saves the session under a dot directory which is removed upon ending the session.
Shell History: Instead of clearing the whole history file, moonwalk reverts it back to how it was including the invokation of moonwalk.

計測したスター増加

24時間: 0
7日間: -1
15日間: 0
1か月: 履歴を収集中

期間ごとの純増数です。期間は重複しており、日別の値ではありません。未計測の値は空欄です。スター数は注目度の指標であり、品質の保証ではありません。

概要

Cover your tracks during Linux Exploitation by leaving zero traces on system logs and filesystem timestamps.

セキュリティ

README.md

オリジナル

`moonwalk`

Cover your tracks during Linux Exploitation / Penetration Testing by leaving zero traces on system logs and filesystem timestamps.

📖 Table of Contents

ℹ️ Introduction

moonwalk is a 400 KB single-binary executable that can clear your traces while penetration testing a Unix machine. It saves the state of system logs pre-exploitation and reverts that state including the filesystem timestamps post-exploitation leaving zero traces of a ghost in the shell.

⚠️ NOTE: This tool is open-sourced to assist solely in Red Team operations and in no means is the author liable for repercussions caused by any prohibited use of this tool. Only make use of this in a machine you have permission to test.

Features

Small Executable: Get started quickly with a curl fetch to your target machine.
Fast: Performs all session commands including logging, trace clearing, and filesystem operations in under 5 milliseconds.
Reconnaissance: To save the state of system logs, moonwalk finds a world-writable path and saves the session under a dot directory which is removed upon ending the session.
Shell History: Instead of clearing the whole history file, moonwalk reverts it back to how it was including the invokation of moonwalk.
Filesystem Timestamps: Hide from the Blue Team by reverting the access/modify timestamps of files back to how it was using the GET command.

Installation

$ curl -L https://github.com/mufeedvh/moonwalk/releases/download/v1.0.0/moonwalk_linux -o moonwalk

(AMD x86-64)

Download the executable from Releases OR Install with cargo:

$ cargo install --git https://github.com/mufeedvh/moonwalk.git

Install Rust/Cargo

Build From Source

Prerequisites:

Git
Rust
Cargo (Automatically installed when installing Rust)
A C linker (Only for Linux, generally comes pre-installed)

$ git clone https://github.com/mufeedvh/moonwalk.git
$ cd moonwalk/
$ cargo build --release

The first command clones this repository into your local machine and the last two commands enters the directory and builds the source in release mode.

Usage

Once you get a shell into the target Unix machine, start a moonwalk session by running this command:

$ moonwalk start

While you're doing recon/exploitation and messing with any files, get the touch timestamp command of a file beforehand to revert it back after you've accessed/modified it:

$ moonwalk get ~/.bash_history

Post-exploitation, clear your traces and close the session with this command:

$ moonwalk finish

That's it!

Contribution

Ways to contribute:

Suggest a feature
Report a bug
Fix something and open a pull request
Help me document the code
Spread the word
Find something I missed which leaves any trace!

License

Licensed under the MIT License, see LICENSE for more information.