Covermyass is a post-exploitation tool designed to securely erase log files and cover tracks on compromised machines across multiple operating systems.
Post-exploitation tool to cover your tracks on a compromised machine (beta)
This tool is primarily used by penetration testers and red teamers during the post-exploitation phase to identify and securely delete log files that could reveal their presence on a compromised system. It helps users cover their tracks before exiting the target machine, making forensic recovery of erased logs significantly harder. The tool supports major OS platforms including Linux, macOS, and plans for Windows support.
The tool is currently in beta and primarily supports Linux and macOS; Windows support is planned but not yet available. Users should run the tool with appropriate permissions (e.g., root) to maximize the ability to erase log files. Overwriting files multiple times with random data followed by zeros helps reduce forensic recovery chances but may increase operation time. Always verify downloaded binaries using the provided PGP signatures and checksums to ensure integrity and authenticity.
Download the latest release binary for your OS from the GitHub releases page using curl, e.g.: curl -sSL https://github.com/sundowndev/covermyass/releases/latest/download/covermyass_linux_amd64 -o ./covermyass
Make the binary executable: chmod +x ./covermyass
Optionally verify digital signatures by downloading the binary, checksums, and signature files
Import the PGP public key using gpg --keyserver https://keys.openpgp.org --recv-keys 0xE5BC23488DA8C7AC
Verify the signature with gpg --verify covermyass_SHA256SUMS.gpg covermyass_SHA256SUMS
Verify the checksum with sha256sum --ignore-missing -c covermyass_SHA256SUMScovermyass
Run an analysis to scan and list existing log files without erasing anything.
covermyass --write -n 100
Overwrite found log files 100 times with random data to securely erase them.
covermyass --write -z -n 5
Overwrite log files 5 times with random data followed by a final overwrite with zeros to hide shredding.
covermyass --list
Show found log files in a simple list format without performing any write or erase operations.
covermyass --filter '/var/log/btmp'
Ignore specified file paths using glob patterns during scanning or erasure.
covermyass --no-read-only --list
List files excluding read-only files.
covermyass -h
Display help information and available command line flags.
covermyass -v
Display the current version of the covermyass tool.