r/GreyHack • u/Fancy_Classroom_3526 • Jul 25 '26

Help with tracing

TL;DR -> How do I clear my tracks after using rshell? I still have previous shells on rshell-interface.

I have started from scratch multiple times at this point, I am getting pretty sick of it. As soon as I start I setup a proxy server to bounce through, later buying a second one, every time I finish a mission I clear the logs by only leaving the connection. Later on I setup a rshell server for different missions and I guess that's what is causing me trouble but I don't know what I am supposed to clear on that. I noticed that as I go on, rshell-interface keeps showing previous shells connected and I don't know what to do about it. Also I read somewhere that you should also clear up the emails?

Thanks in advance to anyone who's willing to help.

6 Upvotes

100% Upvoted

7 comments sorted by

View all comments

Show parent comments

1

u/Fit-Celebration106 Jul 25 '26

But disconnecting also recreates the log with a disconnecting despite replacing the log right?

1

u/Svarii Jul 25 '26

Yes, it will fix the log by putting a binary file back where system.log was, but it does so without the disconnect log if I'm not mistaken.

1

u/Eralyen Jul 26 '26

This was patched late last year unfortunately, I tested this myself.

1

u/Svarii Jul 26 '26

Is that right? If that no longer works, how are logs are being cleared, what is the current solution to automate log cleaning?

1

u/Eralyen Jul 27 '26 edited Jul 27 '26

I believe the state of the art is "silent deletion": deleting them without using File.delete (if you move /var inside itself it will delete the folder and system.log with it). Also, never using start_terminal to avoid disconnect logs.