[MUSIC PLAYING]
Clearing Windows Event Logs--
in this video, we will be exploring
the process of clearing our tracks on a Windows system
after exploitation, and obviously, post exploitation.
So the process of clearing your tracks when you're done
falls under post exploitation.
And it's extremely important.
And it's a step that you really cannot miss,
or you cannot skip over, and for good reason,
as we'll be exploring within this video.
So because we're dealing with the Windows system,
we need to get an idea of what Windows Event logs are,
as this is pretty much the most important logging system
within the Windows operating system.
So the Windows operating system stores and catalogs
all actions or events that have been performed on the system
and stores them in the Windows event log
or in various Windows Event log files, right?
So event logs are categorized based
on the type of events that they store.
So you'll typically find that you have application logs that
are responsible for storing application or program
events like startups, crashes, shutdowns, et cetera.
You then have your system logs, which are very important.
And these store system events like startups, reboots,
crashes, anything pertinent to the functioning
or the functionality of the system.
And then we have the most important event log,
which is the security logs.
So the security logs store security events
like password changes, authentication failures,
et cetera.
So whenever you're done with a penetration
test or an assessment, it's very important
that you actually go through the process
of clearing the event logs on the target system
that you compromised.
The reason you want to do this is because the event logs
are pretty much the first stop for any forensic investigator
after a compromise has been detected.
So it's therefore very important that you know and understand
how to clear your tracks after you're
done with your assessment.
So the clean-up process will really
revolve around clearing your event logs,
deleting any of the files or exploit code
that you've transferred over to the target, which,
in this case, was fairly minimal.
And that's by design, because you really only need
to understand how to perform your activity
or your various phases of post exploitation automatically,
preferably within memory.
So in our case, the only thing we need to do
is explore the process of clearing
the Windows event logs.
Now, on a Windows system, you can
view the Windows event logs by utilizing the event view
application, which we'll be exploring in a few seconds,
right?
So now that we have an understanding of what
Windows Event logs are, why they are used,
and why they're important in both the context
of a forensic investigator as well as a penetration
tester or a hacker.
Let's take a look at how we can go about clearing the Windows
event logs with my meterpreter.
So just fire up the lab environment.
We'll be utilizing the same lab environment we
utilized in the previous video.
So it's going to be fairly simple.
So I'll see you within the lab environment.
All right, so I'm back within the lab environment.
And as we explored in the previous video,
this lab environment provides you with access
to the attack machine as well as the target machine.
This will be very important, as we'll actually
be viewing the various event logs before we actually
clear them and taking a look at what type of data they store
and why it's so important, right?
So first and foremost, we actually
need to gain access to the target system.
So we're just going to copy the target IP right over here,
which is provided to us.
And we're just going to maximize my terminal.
And I can start up the PostgreSQL Database
Service as usual, and we'll also start up msfconsole.
So we'll give that a couple of seconds to start up.
All right, so the first thing that we want to do
is create a workspace.
And we're just going to call it Cleaev, so Clear Event logs.
And we can then set up the global variable
for the RHOSTS option.
And we'll set that to the target IP.
That'll again save us from having
to type in the target IP address whenever we load a module.
So you should be familiar with how to exploit
the badblue application.
And in this case, we've explored it quite a bit.
So we just need to search for the module badblue.
And we're going to be utilizing the badblue pass
through exploit module here.
There we are.
Copy and we'll say use.
And if we show the options for this module,
you should have the target IP specified as well as
the target port, which, in this case,
we know it's running on port 80.
We only need to set the target to badblue Enterprise Edition
2.7 Universal and type in exploit.
So we'll give that a couple of seconds
to actually provide us with a meterpreter session.
All right, there we are.
So we get a meterpreter session.
Some local system enumeration will not hurt anyone.
There we are.
And getuid, we currently have administrative privileges,
which is required, right?
So you do need elevated privileges in order
to clear the Windows Event log.
That's something that you want to keep in mind here.
Which, of course, by this point, you
should already have, as we have explored the process
of elevating our privileges.
So we head over to the target machine.
And let's open up the Event Viewer
to see what's been logged exactly.
So I'm going to say Event Viewer.
All right, so the Event Viewer is started up.
And that's going to take a while to actually load up.
So under Windows Logs, you can see
it's sorted based on Application, Security, Setup,
System.
But the three here that we mentioned earlier,
we have Application, Security, and System.
So we click on Application Logs.
Again, you can see it's going to say a number of events at 255.
And this is going to take a while to load all of them.
So if we click on Security, there we are.
We have the security logs here.
So based on the time--
as you can see, the current clock is 10:05 PM,
we can see that the last security log was essentially
added here at 10:02.
So if we scroll down, it's sorted
based on the date and time.
In this case, the events that have just occurred
are going to be at the top here.
And of course, you can sort that.
So if we say show to display the actual events
from the latest to the oldest, we can do that as well.
So in our case, we're just going to show
the latest, which was 10:02.
And you can click on it.
And in this case, you can see it looks
like an account was logged off.
So that's a fairly simple security event.
And if we click on System, you can
see that the latest one was 10:02, right?
So nothing really has been logged here.
Nothing really has been logged here after 10:02.
And of course, if we click on Security now,
we'll just wait for that to load up.
Hopefully we can actually view the logs in a few seconds.
For some reason, it looks like the security logs are not
being displayed here.
There we are.
And yeah, so if we click on Security,
we can see there's nothing really
that has been logged in regards to anything that we've
done after we've gained access.
So let's try and do something, right?
So let's say I want to open up a shell session on the target
and get a command prompt.
And I want to change the actual password for the administrator
user.
So I can say net user administrator,
and I can change the password to, maybe,
let's see, Password_123321.
Hit Enter.
As you can see, the command completed successfully.
Well, let's see whether that was actually logged.
So if we click on Security, I'm just
going to load up Security Events again.
And we can see this was 10:07.
Let's click on the first one, User Account Management.
It's going to tell you a user account was changed.
And you can go through the details here.
So it'll tell you the user administrator
account was changed.
And in terms of the value or what was changed,
let's see if we can see that here.
The changed attributes are the SAM account name.
And let's see.
There we are.
The Password Last Set, so it'll tell you
when the password was changed.
And as a forensic investigator, this information
is very, very important.
So if we click on the latest one,
you can see that an attempt was made
to reset an account's password.
So that's the latest event log.
And of course, this just confirms
that the password was changed.
So you can see that all our actions are actually
being logged.
All right, and this is not good.
Because if there is an indicator of compromise,
then the forensic investigator will essentially
disconnect this system from the internet
and then begin exploring the actual event logs, right?
So let's take a look at how we can clear all of this.
So it really is very, very simple with meterpreter.
All you need to do is just terminate the channel and head
back over into your meterpreter session.
And we type in clearev.
Hit Enter.
As you can see, it's going to wipe
255 records from Application, System, and Security,
which is fantastic.
So let's actually confirm and see
whether this was actually done.
So if we head over to the Windows logs.
And let's click on Security now.
As you can see, the latest one was 10:08.
And if we click on that, this will just tell you
that the audit log was cleared.
So that's really not helpful for a forensic investigator
because the user that did it was the administrator, right?
So again, you can see that it's cleared the application logs,
the security logs, as well as the system logs here.
And of course, this one right over here
just tells you that the remote registry service
entered the stopped state.
And Event Log, the system log file was cleared, right?
So you can see how helpful this is
for an attacker or a penetration test
irregardless of whether they're a white attacker
or a black attacker.
This is very, very important to do.
So that is how to clear your tracks on a Windows system.
Now, as I said, clearing your event
logs is just one part of the process.
The next thing you need to do is delete or wipe
the actual exploit files or executables
that you transferred over to the target system,
which, in our case, we didn't do much apart from Mimikatz.
And of course, it's fairly simple to remove a file.
You just type in rm, delete it, et cetera.
So that is going to conclude the practical demonstration
site of this video.
In the next video, we will be exploring the process
of performing pivoting.
So once we have gained access, we'll
be exploring how we can essentially
pivot to other systems that are currently on the target system
network or the network that the system is connected to
and how we can exploit other devices or other computers that
are part of that network through the exploited host, right?
So I'll see you in the next video.