🗑️ Shit Cleaner

"In the cyber world, there is no such thing as a 'footprint cleaner'; you must be so invisible that nothing remains to clean."

⚠️ URGENT WARNING

🔴 DO NOT RUN THIS ON YOUR OWN SYSTEM - PRODUCTION USE ONLY ON TARGET MACHINES

"Footprints aren't erased; they should never have existed in the first place."

This tool is designed for post-exploitation evidence removal in penetration testing and red team operations. If you've made a mess and need to minimize the damage, this tool can help you clean up the evidence of your attack!

🎯 What is Shit-Cleaner?

Shit-Cleaner is an advanced Anti-Forensics & Evidence Destruction Toolkit designed for:

🕵️ Post-Exploitation Cleanup - Remove all traces of your presence
🔥 Evidence Destruction - Securely wipe logs, files, and artifacts
🎭 Timestomping - Alter file timestamps to confuse investigators
🧹 System Sanitization - Clean browser history, cache, and user activity
🚀 Zero-Footprint Operations - Leave no trace behind

"In the cyber world, there is no such thing as a 'footprint cleaner'; you must be so invisible that nothing remains to clean."

📋 Features

🪟 Windows Capabilities

✅ Clear all Windows Event Logs (Application, System, Security, PowerShell, etc.)
✅ Flush USN Journal
✅ Delete Prefetch, Amcache, Shimcache
✅ Clear BAM/DAM, SRUM
✅ Remove UserAssist, RecentDocs, RunMRU
✅ Clear JumpLists, Thumbnail Cache
✅ Remove Windows Update Logs
✅ Wipe Defender Logs & Quarantine
✅ Clear Firewall Logs
✅ Stop ETW Trace Sessions
✅ Delete WER Logs
✅ Clear CompatTel Data
✅ Remove PowerShell History
✅ Empty Recycle Bin
✅ Clear Browser Cache (Chrome, Edge)
✅ Flush DNS Cache
✅ Delete Shadow Copies
✅ Clear Registry Backups
✅ Remove Scheduled Tasks
✅ Clear Windows Search Index
✅ Remove RDP Artifacts
✅ Clear MuiCache, WordWheel, TypedPaths
✅ Clear Open/Save MRU, Network MRU

🐧 Linux Capabilities

✅ Clear Syslog, Auth Log, Kernel Log
✅ Wipe Journald Logs
✅ Remove Shell History (Bash, Zsh)
✅ Clear SSH Logs
✅ Wipe Sudo Logs
✅ Clear Cron Logs
✅ Remove Apache, Nginx Logs
✅ Clear MySQL, PostgreSQL Logs
✅ Delete Fail2ban, UFW Logs
✅ Clear Package Cache (APT/YUM)
✅ Remove Mail Logs
✅ Clear Xorg, CUPS Logs
✅ Wipe Docker Logs
✅ Clear Firewalld Logs
✅ Remove APT/YUM History
✅ Clear SSH Keys
✅ Remove Bashrc, Zshrc
✅ Clear Sudoers & Crontab

🛡️ Advanced Features

🔐 Audit Policy Bypass - Temporarily disable system auditing
🛑 Service Termination - Stop logging services (EventLog, Syslog, etc.)
🧠 Memory Artifacts Cleanup - Clear RAM caches and history
🌐 Network Artifacts - Flush ARP cache, firewall logs
📱 Application Artifacts - Clear app caches and data
⏰ Timestomping - Change timestamps of remaining files
🔥 Secure Shredding - Multi-pass overwrite (up to 7 passes)
🧪 Dry Run Mode - Preview what will be deleted

🚀 Installation

# Clone the repository
git clone https://github.com/batmanpriv/Shit-Cleaner.git
cd Shit-Cleaner

# Build
go build -o shitcleaner

# Or install directly
go install github.com/batmanpriv/Shit-Cleaner@latest

📖 Usage

Basic Usage

# Run with default settings (FORCE MODE ENABLED)
./shitcleaner

# Verbose mode with dry run (preview only)
./shitcleaner --verbose --dry-run

# Secure shred with 7 passes
./shitcleaner --shred --passes 7

# Disable audit policies during cleanup
./shitcleaner --verbose --no-audit

# Full stealth mode (all features enabled)
./shitcleaner --verbose --shred --passes 7 --no-timestomp

Command Line Options

Options:
  -v, --verbose        Show detailed output
  --dry-run            Preview what would be deleted (NO CHANGES)
  --shred              Use secure shred (7 passes by default)
  --passes N           Number of shred passes (default: 7)
  --no-parallel        Run operations sequentially
  --no-audit           Don't disable audit policies
  --no-timestomp       Don't timestomp remaining files
  -h, --help           Show this help

⚙️ How It Works

Phase 1: Preparation

Disables audit policies (Windows: auditpol, Linux: auditctl)
Stops logging services (EventLog, Syslog, journald, etc.)
Prepares the system for clean wiping

Phase 2: Memory Cleanup

Clears Windows memory artifacts
Flushes Linux caches and swap
Removes history from active sessions

Phase 3: Evidence Destruction

Clears OS-specific logs
Removes application artifacts
Wipes browser history and cache
Cleans network traces
Securely shreds sensitive files

Phase 4: Cover Tracks

Timestomps remaining files
Final cleanup of temporary files
Restores audit policies (if disabled)

🎯 Anti-Forensics Techniques Used

📊 Log Destruction

Windows Event Log clearing (wevtutil cl)
Linux journal flush (journalctl --vacuum-size=1)
Shell history clearing (history -c)
Application log deletion

🗄️ File System Artifacts

USN Journal flushing
Prefetch file deletion
Amcache removal
Shimcache clearing
Thumbnail cache wiping

🔬 Memory Forensics

RAM cache clearing
Swap flushing
PowerShell history clearing
Shell variable removal

🌐 Network Forensics

DNS cache flushing
ARP cache clearing
Firewall log removal
Connection tracking flush

⏰ Timestomping

Changing file modification times
Altering directory timestamps
Creating fake timestamps

🔥 Secure Deletion

Multi-pass overwrite (0x00, 0xFF, 0x55, 0xAA)
Random data overwrite
File synchronization

🔒 Security Considerations

"Footprints aren't erased; they should never have been there in the first place."

⚠️ Important Notes

SSD Warning: Shred is not effective on SSDs, journaling filesystems, or copy-on-write filesystems
Root/Admin Required: Many operations require elevated privileges
Windows Defender: May flag this tool as malicious
Data Loss: Permanent deletion - no recovery possible
Legal Use Only: For authorized penetration testing only
Noob Hacker: Even if all the artifacts targeted by the program are removed, deleting a local artifact does not equate to erasing all traces. For instance, an endpoint might have sent telemetry to an EDR or SIEM prior to the deletion, or a previous backup or snapshot might exist.

Best Practices

Use --dry-run first to preview changes

🏗️ Project Structure

Shit-Cleaner/
├── main.go                 # Main application
├── go.mod                  # Go module file
├── README.md              # Documentation
├── LICENSE                # MIT License

🧪 Testing

Dry Run Example

./shitcleaner --dry-run --verbose

Output:

[*] Shit Cleaner v1.0.0
[*] OS: linux
[*] DRY RUN MODE - No changes will be made

[*] Disabling audit policies...
    [DRY RUN] sh -c auditctl -e 0 2>/dev/null || echo 0 > /proc/sys/kernel/audit_enabled
[*] Stopping logging services...
[*] Clearing network artifacts...
[*] Clearing application artifacts...
[*] Timestomping remaining artifacts...
[*] Final Cleanup...

Full Cleanup Example

sudo ./shitcleaner --verbose --shred --passes 7

Output:

[*] Shit Cleaner v1.0.0
[*] OS: linux
[*] Shred passes: 7
[*] Audit policies will be disabled during cleanup

[*] Disabling audit policies...
[*] Stopping logging services...
[*] Clearing Linux memory artifacts...
[*] Clearing Syslog...
[*] Clearing Auth Logs...
[*] Clearing Kernel Logs...
[*] Clearing Journald Logs...
[*] Clearing Shell History...
[*] Clearing SSH Logs...
[*] Clearing Sudo Logs...
...
[✓] Cleanup completed!
─────────────────────────────────────
  Files deleted:  487
  Directories:    23
  Logs cleared:   156
  Total size:     281.0.06 MB
  Duration:       42.7s
─────────────────────────────────────

🔄 Compatibility

✅ Supported Operating Systems

Windows: 7, 8, 10, 11 (x64)
Windows Server: 2012, 2016, 2019, 2022
Linux: Ubuntu, Debian, CentOS, RHEL, Fedora
Linux: Kernel 3.10+

✅ Required Privileges

Windows: Administrator privileges
Linux: Root privileges (sudo)

🛠️ Troubleshooting

Common Issues

❌ "Access Denied"

# Run with elevated privileges
sudo ./shitcleaner  # Linux
# Run as Administrator  # Windows

❌ "Shred not working on SSD"

# Use normal deletion instead
./shitcleaner --no-shred

Name		Name	Last commit message	Last commit date
Latest commit History 10 Commits
LICENSE		LICENSE
README.md		README.md
go.mod		go.mod
main.go		main.go

Folders and files

Latest commit

History

Repository files navigation