Now, after you complete your penetration test, your next step should be to clean up the mess behind
you.
So long as there's no forensics and event response purpose that the clients planned, you should erase
and cover your tracks.
So although my interpreter resides in the memory during a test, you might add, users create back doors,
routings, registry entries, etc, etc., the list could go on.
All of them should be cleared.
So for this kind of stuff, MSF has two features, the command clearance and the interpreter script
event manager.
Now you can use both so that you don't leave anything behind.
However, you can only run them with an admin level session.
So let me show you how to use them.
So I already have a system level session and I'm going to conduct cleaning from this session.
But first, I want to show you the event logs on Métis Voidable three.
So open minds voidable three.
And from start type event viewer.
And cook it.
Now go to the Windows log's section.
And here are the different categories of log's.
Now, probably what you've done a while ago was logged by windows.
And now I'll assume that there is no forensic purpose of your penetration testing, so it means that
you can clear the logs and all that you've done on the system.
So this action is more or less offensive, but it will be very handy so that you.
You can escape any detection from any of the system administrators.
So let's go back to the maturity session.
And just type clear of.
And that's all.
You just clear the event logs, so let's see what you did from the target.
Refresh the screen from the action menu or click Windows logs again.
Nothing, just a few new ones.
So the second flavor is an interpretive script called event manager.
So run event manager.
Without any parameter, it will display the help menu.
Now, open minds voidable three again.
By the way, I return from the snapshot to show you the logs.
So go to event viewer from the start.
And under Windows logs, you can see how many entries are in log categories.
Then go back to the materialisation.
Type in run event manager.
See the help menu again?
Now, this time, run event manager with the sea parameter.
See, that's very good.
It just deleted the locks.
So let's open Métis Boydell three to see what the script did.
Perfect, you see, it really did delete all the logs.