[WOLGA]

Hey Hackforums,

I have shelled an apache webserver. How would I clear the logs from /apache/logs/access.log after I use the shell, or does this not matter?

[Gee4rce]

Well depends on the type of access you have with that shell,
if you'd only can send comands and get back the final output only, then you'd be better of deleting the access.log and creating a new, empty one.
That's kinda suspicious tough and admin may figure that something is going on (implying he checks logs) but on the other hand better than having the entries in the logs on how the hack was performed.
Or, if you have for example direct connect to the server with live output in shell/putty, then you could use vim/vi/nano to edit out the entries your actions have caused.
If you go for deleting logs, make sure to stop apache Server before deleting the access.log, like this "/etc/init.d/apache2 stop", then delete logs and create new access.log file, then start apache again.
In some cases it might be "/etc/init.d/httpd stop" or "systemctl httpd stop" (for redhat based nix distro).
Cheers, Gee.

[WOLGA]

Well depends on the type of access you have with that shell,
if you'd only can send comands and get back the final output only, then you'd be better of deleting the access.log and creating a new, empty one.
That's kinda suspicious tough and admin may figure that something is going on (implying he checks logs) but on the other hand better than having the entries in the logs on how the hack was performed.
Or, if you have for example direct connect to the server with live output in shell/putty, then you could use vim/vi/nano to edit out the entries your actions have caused.
If you go for deleting logs, make sure to stop apache Server before deleting the access.log, like this "/etc/init.d/apache2 stop", then delete logs and create new access.log file, then start apache again.
In some cases it might be "/etc/init.d/httpd stop" or "systemctl httpd stop" (for redhat based nix distro).
Cheers, Gee.

It is a PHP shell on a windows server, I do not think I can edit the log with the apache webserver disabled.

Essentially, the problem is that the http request to the php shell to edit the log, leaves a log.

[Gee4rce]

It is a PHP shell on a windows server, I do not think I can edit the log with the apache webserver disabled.

Essentially, the problem is that the http request to the php shell to edit the log, leaves a log.

Ahh, i didnt think of the situation that if you stop apache, then you have no access via shell anymore : >

Well how about backconnecting with netcat or so and then use cli?
Then you are not dependand anymore from the webservice running.

Cheers, Gee.

[HaxOr❤]

You could just spam it with other information? Just a tought..

[Vellichor]

Well depends on the type of access you have with that shell,
if you'd only can send comands and get back the final output only, then you'd be better of deleting the access.log and creating a new, empty one.
That's kinda suspicious tough and admin may figure that something is going on (implying he checks logs) but on the other hand better than having the entries in the logs on how the hack was performed.
Or, if you have for example direct connect to the server with live output in shell/putty, then you could use vim/vi/nano to edit out the entries your actions have caused.
If you go for deleting logs, make sure to stop apache Server before deleting the access.log, like this "/etc/init.d/apache2 stop", then delete logs and create new access.log file, then start apache again.
In some cases it might be "/etc/init.d/httpd stop" or "systemctl httpd stop" (for redhat based nix distro).
Cheers, Gee.

Re-read the OP. He's accessing the site through a web shell.

[ProblemSolva]

you need to root the server to have access to the logs mate.

[Gee4rce]

Re-read the OP. He's accessing the site through a web shell.

Correct, thats why i later suggested back connecting to the server.