#
Cleanup
#
Carbon Scenario
#
Setup
To remove artifacts, run the Cleanup Scripts as from the Kali hosts. You can also run the cleanup scripts on each target as described in their respective directories.
- From the Kali Linux machine (
176.59.15.33
):cd /opt/day1/turla xfreerdp +clipboard /u:skt\\\evals_domain_admin /p:"DuapQj7k8Va8U1X27rw6" /v:10.20.10.9 /drive:X,Resources/cleanup
- From the RDP session, open powershell in administrative mode
- Run the cleanup commands for each implant listed below that you need to cleanup
- Sign out of the RDP session when finished.
#
EPIC
-
\\tsclient\X\EPIC\epic_cleanup.ps1 -target hobgoblin -user gunter
#
Carbon
-
$targethosts = "hobgoblin","bannik","khabibulin" foreach ($targethost in $targethosts) { Write-Host "[+] Performing Carbon cleanup on $targethost" Invoke-Command -ComputerName $targethost -FilePath \\tsclient\X\Carbon\carbon_cleanup.ps1 }
#
Penquin
Additional documentation here.
- From the Kali Linux machine, SCP the Penquin cleanup script to KAGAROV:
cd /opt/day1/turla scp Resources/cleanup/Penquin/cleanup_penquin.sh adalwolfa@10.20.10.23:
- Enter
Password2!
when prompted: - Execute the cleanup script, entering
Password2!
when prompted:ssh adalwolfa@10.20.10.23 "sudo ./cleanup_penquin.sh && rm cleanup_penquin.sh"
#
Snake Scenario
#
Setup
To remove artifacts, run the Cleanup Scripts as from the Kali hosts. You can also run the cleanup scripts on each target as described in their respective directories.
- From the Kali Linux machine (
176.59.15.33
):cd /opt/day2/turla xfreerdp +clipboard /u:nk\\\evals_domain_admin /p:"DuapQj7k8Va8U1X27rw6" /v:10.100.30.202 /drive:X Resources/cleanup
- From the RDP session, open powershell in administrative mode and set the execution policy
Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope CurrentUser
- Run the cleanup commands for each implant listed below that you need to cleanup
- Reset the execution policy
Set-ExecutionPolicy -ExecutionPolicy Undefined -Scope CurrentUser
- Sign out of the RDP session when finished.
#
EPIC
-
\\tsclient\X\EPIC\epic_cleanup.ps1 -target azuolas -user egle
#
Snake
-
$targethosts = "azuolas","berzas","uosis" \\tsclient\X\Snake\snake_cleanup.ps1 -targets $targethosts -restart -deleteInstaller
#
LightNeuron
-
Invoke-Command -ComputerName drebule -FileName \\tsclient\X\LightNeuron\lightneuron_cleanup.ps1