Hey everybody.
Welcome to next video.
We're going to be talking about cleaning up now.
This is also known as the cleanup.
But what you want to do is when you compromise a machine you want to keep notes of everything you do.
If you create a backdoor if you create any persistence if you create if you have any background processes
like net cat or an interpreter shell if you migrated your maternal British shell to a different to different
process what ideas was it.
You need to make sure that the system is brought back to its original state.
It doesn't matter if it's Windows or Linux.
Keep track of what you did.
Screenshots what.
Whatever the case you want to do.
Keep track of it and you need to reverse your steps.
If you've migrated to a process restart the service.
If it can't be restarted without a reboot of the system.
Ask for a reboot of the system.
If you added a service delete the service new user account delete the user account.
Any scripts you've dumped on the machine remove them.
Compiled code.
Remove them.
Make sure it is back to exactly the state it was your client will thank you and the organization will
thank you because you do not want to leave a potential suffered.
Let's take a good example here.
So we have you go to an engagement.
You find out that this machines you're able to escalate privileges using some sort of C code right.
You pulled it off exploit DB compiled boom runs but you left it in your home directory or not even your
home guard you left it on some file mount that had read and write access to anybody because of that.
If you've left it there an attacker gains on that machine and they see that exploit D.B. no or exploit
that C or prevent that C or shell that C whatever it is and they just run it.
Now they've got full access to the machine.
You don't want to leave anything behind.
That could potentially leave you open to somebody finding it later and actually exploiting it for real
and not from a systems perspective or from a testing perspective.
Always make sure to document what you have Mike.
Anything that you've done with processes restart them sometimes you might need to bounce the whole machine.
It happens.
Just make sure you have the correct things in place.
Don't just bounce it yourself.
Make sure you get the NOC team in place and get approvals and maintenance windows.
Get it done.
It's gonna be much easier later because if you migrate your interpretation something go screwy two months
down the road because that process is running now the process died.
Nobody has any idea what the hell just happened and that's going to spawn a whole investigation and
waste a lot of people's time.
Don't do it.
Keep track of everything and then make sure you reverse it back and remove everything else that you
added to that system.