safebreach-labs/edraserRemotely delete access logs, Windows event logs, databases, and files on target machines using automated scanning or manual attack selection for post-exploitation cleanup.
EDRaser is a powerful tool for remotely deleting access logs, Windows event logs, databases, and other files on remote machines. It offers two modes of operation: automated and manual.
In automated mode, EDRaser scans the C class of a given address space of IPs for vulnerable systems and attacks them automatically. The attacks in auto mode are:
To use EDRaser in automated mode, follow these steps:
python edraser.py --auto
In manual mode, you can select specific attacks to launch against a targeted system, giving you greater control. Note that some attacks, such as VMX deletion, are for local machines only.
To use EDRaser in manual mode, you can use the following syntax:
python edraser.py --ip <ip_addr> --attack <attack_name> [--sigfile <signature file>]
Arguments:
--ip: scan IP addresses in the specified range and attack vulnerable systems (default: localhost).--sigfile: use the specified encrypted signature DB (default: signatures.db).--attack: attack to be executed. The following attacks are available: ['vmx', 'vmdk', 'windows_security_event_log_remote',
'windows_application_event_log_local', 'syslog',
'access_logs', 'remote_db', 'local_db', 'remote_db_webserver']Optional arguments:
port: port of remote machinedb_username: the username of the remote DB.db_password: the password of the remote DB.db_type: type of the DB, EDRaser supports mysql, sqlite. (# Note that for sqlite, no username\password is needed)db_name: the name of the remote DB to be connected totable_name: the name of the remote table to be connected torpc_tools: path to the VMware rpc_toolsExample:
python edraser.py --attack windows_event_log --ip 192.168.1.133
python EDRaser.py -attack remote_db -db_type mysql -db_username test_user -db_password test_password -ip 192.168.1.10
You can bring up a web interface for inserting and viewing a remote DB. it can be done by the following command: EDRaser.py -attack remote_db_webserver -db_type mysql -db_username test_user -db_password test_password -ip 192.168.1.10
This will bring up a web server on the localhost:8080 address, it will allow you to view & insert data to a remote given DB. This feature is designed to give an example of a "Real world" scenario where you have a website that you enter data into and it keeps it inside a remote DB, You can use this feature to manually insert data into a remote DB.
In manual mode, EDRaser displays a list of available attacks. Here's a brief description of each attack: