10 / Cleanup

Cleanup

Remove artifacts, clear event logs, erase command history and cover your tracks on both Windows and Linux AD machines. Document what you cleaned for the pentest report.

Cleaning Up After an AD Pentest

What to clear and how to do it safely — Windows event logs, prefetch files, PowerShell history, created accounts and uploaded files.

Event LogsPrefetchPowerShell History

soon

Windows Cleanup

wevtutil / powershell / cmd

Clear all Windows event logs

wevtutil el | ForEach-Object { wevtutil cl "$_" }
# or single log:
wevtutil cl System
wevtutil cl Security
wevtutil cl Application

Clear PowerShell history

Remove-Item "$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt" -Force
# or clear current session:
Clear-History

Clear prefetch files (requires admin)

Remove-Item C:\Windows\Prefetch\* -Force

Delete uploaded/created files

del /f /q C:\Windows\Temp\payload.exe
del /f /q C:\Windows\Temp\nc.exe
del /f /q C:\Users\*\Desktop\rce.exe

Remove created user accounts

net user hacker /delete
# domain account:
Remove-ADUser -Identity hacker -Confirm:$false

Revert modified service binpath

sc.exe config cfn-hup binpath="C:\original\path\to\service.exe"

Clear recent run history and temp files

reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /va /f
Remove-Item "$env:TEMP\*" -Recurse -Force

Disable/remove scheduled tasks you created

schtasks /delete /tn "TaskName" /f

Revert ACL changes made via dacledit/Add-DomainObjectAcl

# Document changes made during the test
# Use dacledit.py to remove added rights
dacledit.py $DOMAIN/$USERNAME:'<password>'@$TARGET_IP \
  -action remove -rights FullControl -target <target_object> -ace-target <your_user>

Linux Cleanup (AD-joined / pivot hosts)

bash history / logs

Clear bash history

history -c && history -w
echo "" > ~/.bash_history
unset HISTFILE

Remove SSH keys you added

sed -i '/your_public_key/d' ~/.ssh/authorized_keys

Clean logs

/var/log/auth.log
/var/log/syslog
/var/log/<service>/
/var/log/apache2/access.log

Remove uploaded tools and files

rm -f /tmp/chisel /tmp/socat /tmp/linpeas.sh
rm -f ~/Tools/ntlm_theft/test*

Documentation Checklist

for the report

Document everything that was cleaned for the report

# For each item:
# - What was created/modified (file path, registry key, AD object, service)
# - When it was created
# - Whether it was successfully removed
# - Any residual changes that could not be reverted

← Data Exfiltration