In this lesson, we're going to talk
about removing tools after a pen test.
During a test, various tools like Metasploit payloads,
keyloggers, and vulnerability scanner agents
might be added to the system to exploit vulnerabilities.
We need to make sure that we remove these tools
to maintain the system to original operational baseline
and prevent any leftover holes in security, which we created
during the test, from being used by future attackers.
Let's start with tools that might be loaded into memory,
such as certain Metasploit payloads.
These tools are usually automatically removed
when the system reboots.
For example, if you use a Metasploit reverse shell
that only exists in memory,
it will be cleared upon restarting the machine.
However, some tools persist on a disk
and must be manually uninstalled.
For persistent tools,
just deleting them might not be enough.
Simply deleting the executable file doesn't guarantee
that all traces of the tool are gone.
For instance, if you installed a keylogger,
you might need to remove not only the program itself,
but also any associated data files.
This can include log and configuration files.
To securely remove these files,
you might use the shredding tool
that overwrites the data several times,
making it nearly impossible to recover.
Tools like shred On Linux
or third-party applications like CCleaner on Windows
can help with this process.
Imagine you install a vulnerability scanner agent
on a target system.
After the test, you would need to uninstall the agent using
the software's uninstallation process.
If the scanner left behind any configuration
or log files, these should also be located
and securely deleted.
You might find these log files in the /var/log directory
in a Linux system
or in the installation directory on the Windows system.
Using secure deletion methods ensures
that these files cannot be recovered
by someone who is up to no good.
And finally, any script or automated tasks that were created
to run these tools, they need to also be removed.
For example, you might have set up a cron job in Linux
to run a vulnerability scanner periodically.
After the test, you need to edit the crontab file
by running the crontab -e
and removing the related entry.
Similarly, on Windows systems,
you would delete any scheduled task using
the Task Scheduler interface or the schtasks command.
So remember, removing tools after a penetration test
is important for maintaining the security of the system.
By thoroughly uninstalling all tools,
securely deleting associated files,
and removing any automated tasks,
you ensure no residual artifacts remain
that could be exploited in the future.