痕迹清理-Windows篇-02

单条日志清理

参考三好大佬的文章

https://3gstudent.github.io/Windows-XML-Event-Log-(EVTX)%E5%8D%95%E6%9D%A1%E6%97%A5%E5%BF%97%E6%B8%85%E9%99%A4-%E4%B8%80-%E5%88%A0%E9%99%A4%E6%80%9D%E8%B7%AF%E4%B8%8E%E5%AE%9E%E4%BE%8B

evtx基础知识

参考https://github.com/libyal/libevtx/blob/main/documentation/Windows XML Event Log (EVTX).asciidoc

evtx文件结构包含3部分

file header
chunks
trailing empty values

file header

https://github.com/libyal/libevtx/blob/main/documentation/Windows%20XML%20Event%20Log%20(EVTX).asciidoc#2-file-header

chunks

https://github.com/libyal/libevtx/blob/main/documentation/Windows%20XML%20Event%20Log%20(EVTX).asciidoc#3-chunk

trailing empty values

https://github.com/libyal/libevtx/blob/master/documentation/Windows%20XML%20Event%20Log%20%28EVTX%29.asciidoc#32-event-record

具体操作

查看日志文件

使用事件查看器查看

这里要删除的记录为1915

删除后效果如下

使用python脚本查看

可以使用该工具 https://github.com/williballenthin/python-evtx

python evtx_record_structure.py System.evtx 1915

C:\Users\TEST\Desktop>python evtx_record_structure.py System.evtx 1915
00000000: 2A 2A 00 00 38 01 00 00  7B 07 00 00 00 00 00 00  **..8...{.......
00000010: 23 EB 07 A2 D4 FB D3 01  0F 01 01 00 0C 01 65 CE  #.............e.
00000020: 1B C7 EE 0D 00 00 14 00  00 00 01 00 04 00 01 00  ................
00000030: 04 00 02 00 06 00 02 00  06 00 02 00 06 00 08 00  ................
00000040: 15 00 08 00 11 00 00 00  00 00 04 00 08 00 04 00  ................
00000050: 08 00 08 00 0A 00 01 00  04 00 00 00 00 00 00 00  ................
00000060: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
00000070: 00 00 00 00 00 00 8B 00  21 00 04 00 00 00 7C 1B  ........!.....|.
00000080: 00 40 00 00 00 00 00 00  80 80 23 EB 07 A2 D4 FB  .@........#.....
00000090: D3 01 D8 01 00 00 9C 07  00 00 7B 07 00 00 00 00  ..........{.....
000000A0: 00 00 00 0F 01 01 00 0C  01 DE E1 DC 34 6C 11 00  ............4l..
000000B0: 00 04 00 00 00 4E 00 01  00 08 00 01 00 04 00 08  .....N..........
000000C0: 00 0E 00 0E 00 42 00 61  00 63 00 6B 00 67 00 72  .....B.a.c.k.g.r
000000D0: 00 6F 00 75 00 6E 00 64  00 20 00 49 00 6E 00 74  .o.u.n.d. .I.n.t
000000E0: 00 65 00 6C 00 6C 00 69  00 67 00 65 00 6E 00 74  .e.l.l.i.g.e.n.t
000000F0: 00 20 00 54 00 72 00 61  00 6E 00 73 00 66 00 65  . .T.r.a.n.s.f.e
00000100: 00 72 00 20 00 53 00 65  00 72 00 76 00 69 00 63  .r. .S.e.r.v.i.c
00000110: 00 65 00 63 6B 28 57 D0  8F 4C 88 0E 00 00 00 42  .e.ck(W..L.....B
00000120: 00 49 00 54 00 53 00 2F  00 34 00 00 00 00 00 00  .I.T.S./.4......
00000130: 15 00 00 00 38 01 00 00                           ....8...
record(absolute_offset=8776)
RootNode(offset=0x18)
  StreamStartNode(offset=0x18)
  TemplateInstanceNode(offset=0x1c, resident=False)
  Substitutions(offset=0x26)
    UnsignedByteTypeNode(offset=0x7a) --> 4
    UnsignedByteTypeNode(offset=0x7b) --> 0
    UnsignedWordTypeNode(offset=0x7c) --> 0
    UnsignedWordTypeNode(offset=0x7e) --> 7036
    UnsignedWordTypeNode(offset=0x80) --> 16384
    Hex64TypeNode(offset=0x82) --> 0x8080000000000000
    FiletimeTypeNode(offset=0x8a) --> 2018-06-04 07:21:19.394281
    NullTypeNode(offset=0x92)
    UnsignedDwordTypeNode(offset=0x92) --> 472
    UnsignedDwordTypeNode(offset=0x96) --> 1948
    UnsignedQwordTypeNode(offset=0x9a) --> 1915
    UnsignedByteTypeNode(offset=0xa2) --> 0
    NullTypeNode(offset=0xa3)
    NullTypeNode(offset=0xa3)
    NullTypeNode(offset=0xa3)
    NullTypeNode(offset=0xa3)
    NullTypeNode(offset=0xa3)
    NullTypeNode(offset=0xa3)
    NullTypeNode(offset=0xa3)
    BXmlTypeNode(offset=0xa3) -->
      RootNode(offset=0xa3)
        StreamStartNode(offset=0xa3)
        TemplateInstanceNode(offset=0xa7, resident=False)
        Substitutions(offset=0xb1)
          WstringTypeNode(offset=0xc5) --> Background Intelligent Transfer Servi
ce
          WstringTypeNode(offset=0x113) --> 正在运行
          UnsignedDwordTypeNode(offset=0x11b) --> 14
          BinaryTypeNode(offset=0x11f) --> QgBJAFQAUwAvADQAAAA=


<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Pr
ovider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f
4}" EventSourceName="Service Control Manager"></Provider>
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2018-06-04 07:21:19.394281"></TimeCreated>
<EventRecordID>1915</EventRecordID>
<Correlation ActivityID="" RelatedActivityID=""></Correlation>
<Execution ProcessID="472" ThreadID="1948"></Execution>
<Channel>System</Channel>
<Computer>WIN-E8C6J8CN50O</Computer>
<Security UserID=""></Security>
</System>
<EventData><Data Name="param1">Background Intelligent Transfer Service</Data>
<Data Name="param2">&#27491;&#22312;&#36816;&#34892;</Data>
<Binary>QgBJAFQAUwAvADQAAAA=</Binary>
</EventData>
</Event>

删除单条日志思路——覆盖

修改日志 Event Record size长度，然后覆盖掉下一条日志，这样windows在解析日志时，下一条日志就会被隐藏，从而实现所谓的单条目录的删除

具体方法:

1.file header中的Next record identifier减一
2.重新计算file header 中的 chunksum
3.修改Event Record:

重新计算待删除Event Record前后长度，更新后续Event Record的Event record identifier
4.更新ElfChnk，

删除单条日志的实例

实例样本 https://github.com/3gstudent/Eventlogedit-evtx--Evolution/blob/master/System.evtx

File header Next record identifier值 -1

这里采用小端序 0x077c 减一后为 0x77b

重新计算checksum值

计算前120bytes 的 CRC32，直接引用大佬的脚本

import binascii   
def crc2hex(crc):   
    return '%08x' % (binascii.crc32(binascii.a2b_hex(crc)) & 0xffffffff)     

d='456C6646696C6500000000000000000000000000000000007B0700000000000080000000010003000010010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'  
print(crc2hex(d)