Shit-Cleaner

README

🗑️ Shit Cleaner

"In the cyber world, there is no such thing as a 'footprint cleaner'; you must be so invisible that nothing remains to clean."

---

⚠️ URGENT WARNING

🔴 DO NOT RUN THIS ON YOUR OWN SYSTEM - PRODUCTION USE ONLY ON TARGET MACHINES

"Footprints aren't erased; they should never have existed in the first place."

This tool is designed for post-exploitation evidence removal in penetration testing and red team operations. If you've made a mess and need to minimize the damage, this tool can help you clean up the evidence of your attack!

---

🎯 What is Shit-Cleaner?

Shit-Cleaner is an advanced Anti-Forensics & Evidence Destruction Toolkit designed for:

• 🕵️ Post-Exploitation Cleanup - Remove all traces of your presence
• 🔥 Evidence Destruction - Securely wipe logs, files, and artifacts
• 🎭 Timestomping - Alter file timestamps to confuse investigators
• 🧹 System Sanitization - Clean browser history, cache, and user activity
• 🚀 Zero-Footprint Operations - Leave no trace behind

"In the cyber world, there is no such thing as a 'footprint cleaner'; you must be so invisible that nothing remains to clean."

---

📋 Features

🪟 Windows Capabilities

• ✅ Clear all Windows Event Logs (Application, System, Security, PowerShell, etc.)
• ✅ Flush USN Journal
• ✅ Delete Prefetch, Amcache, Shimcache
• ✅ Clear BAM/DAM, SRUM
• ✅ Remove UserAssist, RecentDocs, RunMRU
• ✅ Clear JumpLists, Thumbnail Cache
• ✅ Remove Windows Update Logs
• ✅ Wipe Defender Logs & Quarantine
• ✅ Clear Firewall Logs
• ✅ Stop ETW Trace Sessions
• ✅ Delete WER Logs
• ✅ Clear CompatTel Data
• ✅ Remove PowerShell History
• ✅ Empty Recycle Bin
• ✅ Clear Browser Cache (Chrome, Edge)
• ✅ Flush DNS Cache
• ✅ Delete Shadow Copies
• ✅ Clear Registry Backups
• ✅ Remove Scheduled Tasks
• ✅ Clear Windows Search Index
• ✅ Remove RDP Artifacts
• ✅ Clear MuiCache, WordWheel, TypedPaths
• ✅ Clear Open/Save MRU, Network MRU

🐧 Linux Capabilities

• ✅ Clear Syslog, Auth Log, Kernel Log
• ✅ Wipe Journald Logs
• ✅ Remove Shell History (Bash, Zsh)
• ✅ Clear SSH Logs
• ✅ Wipe Sudo Logs
• ✅ Clear Cron Logs
• ✅ Remove Apache, Nginx Logs
• ✅ Clear MySQL, PostgreSQL Logs
• ✅ Delete Fail2ban, UFW Logs
• ✅ Clear Package Cache (APT/YUM)
• ✅ Remove Mail Logs
• ✅ Clear Xorg, CUPS Logs
• ✅ Wipe Docker Logs
• ✅ Clear Firewalld Logs
• ✅ Remove APT/YUM History
• ✅ Clear SSH Keys
• ✅ Remove Bashrc, Zshrc
• ✅ Clear Sudoers & Crontab

🛡️ Advanced Features

• 🔐 Audit Policy Bypass - Temporarily disable system auditing
• 🛑 Service Termination - Stop logging services (EventLog, Syslog, etc.)
• 🧠 Memory Artifacts Cleanup - Clear RAM caches and history
• 🌐 Network Artifacts - Flush ARP cache, firewall logs
• 📱 Application Artifacts - Clear app caches and data
• ⏰ Timestomping - Change timestamps of remaining files
• 🔥 Secure Shredding - Multi-pass overwrite (up to 7 passes)
• 🧪 Dry Run Mode - Preview what will be deleted

---

🚀 Installation

# Clone the repository
git clone https://github.com/batmanpriv/Shit-Cleaner.git
cd Shit-Cleaner

# Build
go build -o shitcleaner

# Or install directly
go install github.com/batmanpriv/Shit-Cleaner@latest

---

📖 Usage

Basic Usage

# Run with default settings (FORCE MODE ENABLED)
./shitcleaner

# Verbose mode with dry run (preview only)
./shitcleaner --verbose --dry-run

# Secure shred with 7 passes
./shitcleaner --shred --passes 7

# Disable audit policies during cleanup
./shitcleaner --verbose --no-audit

# Full stealth mode (all features enabled)
./shitcleaner --verbose --shred --passes 7 --no-timestomp

Command Line Options

Options:
  -v, --verbose        Show detailed output
  --dry-run            Preview what would be deleted (NO CHANGES)
  --shred              Use secure shred (7 passes by default)
  --passes N           Number of shred passes (default: 7)
  --no-parallel        Run operations sequentially
  --no-audit           Don't disable audit policies
  --no-timestomp       Don't timestomp remaining files
  -h, --help           Show this help

---

⚙️ How It Works

Phase 1: Preparation

1. Disables audit policies (Windows: auditpol, Linux: auditctl)
2. Stops logging services (EventLog, Syslog, journald, etc.)
3. Prepares the system for clean wiping

Phase 2: Memory Cleanup

1. Clears Windows memory artifacts
2. Flushes Linux caches and swap
3. Removes history from active sessions

Phase 3: Evidence Destruction

1. Clears OS-specific logs
2. Removes application artifacts
3. Wipes browser history and cache
4. Cleans network traces
5. Securely shreds sensitive files

Phase 4: Cover Tracks

1. Timestomps remaining files
2. Final cleanup of temporary files
3. Restores audit policies (if disabled)

---

🎯 Anti-Forensics Techniques Used

📊 Log Destruction

• Windows Event Log clearing (wevtutil cl)
• Linux journal flush (journalctl --vacuum-size=1)
• Shell history clearing (history -c)
• Application log deletion

🗄️ File System Artifacts

• USN Journal flushing
• Prefetch file deletion
• Amcache removal
• Shimcache clearing
• Thumbnail cache wiping

🔬 Memory Forensics

• RAM cache clearing
• Swap flushing
• PowerShell history clearing
• Shell variable removal

🌐 Network Forensics

• DNS cache flushing
• ARP cache clearing
• Firewall log removal
• Connection tracking flush

⏰ Timestomping

• Changing file modification times
• Altering directory timestamps
• Creating fake timestamps

🔥 Secure Deletion

• Multi-pass overwrite (0x00, 0xFF, 0x55, 0xAA)
• Random data overwrite
• File synchronization

---

🔒 Security Considerations

"Footprints aren't erased; they should never have been there in the first place."

⚠️ Important Notes

1. SSD Warning: Shred is not effective on SSDs, journaling filesystems, or copy-on-write filesystems
2. Root/Admin Required: Many operations require elevated privileges
3. Windows Defender: May flag this tool as malicious
4. Data Loss: Permanent deletion - no recovery possible
5. Legal Use Only: For authorized penetration testing only

🛡️ Best Practices

1. Use --dry-run first to preview changes
2. Test in isolated environment before deployment
3. Always have backup before running
4. Document all operations for accountability

---

🏗️ Project Structure

Shit-Cleaner/
├── main.go                 # Main application
├── go.mod                  # Go module file
├── README.md              # Documentation
├── LICENSE                # MIT License
└── .gitignore            # Git ignore rules

---

🧪 Testing

Dry Run Example

./shitcleaner --dry-run --verbose

Output:

[*] Shit Cleaner v1.0.0
[*] OS: linux
[*] DRY RUN MODE - No changes will be made

[*] Disabling audit policies...
    [DRY RUN] sh -c auditctl -e 0 2>/dev/null || echo 0 > /proc/sys/kernel/audit_enabled
[*] Stopping logging services...
[*] Clearing network artifacts...
[*] Clearing application artifacts...
[*] Timestomping remaining artifacts...
[*] Final Cleanup...

Full Cleanup Example

sudo ./shitcleaner --verbose --shred --passes 7

Output:

[*] Shit Cleaner v1.0.0
[*] OS: linux
[*] Shred passes: 7
[*] Audit policies will be disabled during cleanup

[*] Disabling audit policies...
[*] Stopping logging services...
[*] Clearing Linux memory artifacts...
[*] Clearing Syslog...
[*] Clearing Auth Logs...
[*] Clearing Kernel Logs...
[*] Clearing Journald Logs...
[*] Clearing Shell History...
[*] Clearing SSH Logs...
[*] Clearing Sudo Logs...
...
[✓] Cleanup completed!
─────────────────────────────────────
  Files deleted:  487
  Directories:    23
  Logs cleared:   156
  Total size:     281.0.06 MB
  Duration:       42.7s
─────────────────────────────────────

---

🔄 Compatibility

✅ Supported Operating Systems

• Windows: 7, 8, 10, 11 (x64)
• Windows Server: 2012, 2016, 2019, 2022
• Linux: Ubuntu, Debian, CentOS, RHEL, Fedora
• Linux: Kernel 3.10+

✅ Required Privileges

• Windows: Administrator privileges
• Linux: Root privileges (sudo)

---

🛠️ Troubleshooting

Common Issues

❌ "Access Denied"

# Run with elevated privileges
sudo ./shitcleaner  # Linux
# Run as Administrator  # Windows

❌ "Command not found"

# Ensure all dependencies are installed
# Linux: apt-get install auditd systemd  # Debian/Ubuntu
# Windows: Ensure wevtutil, auditpol exist

❌ "Shred not working on SSD"

# Use normal deletion instead
./shitcleaner --no-shred