#
Cleanup
#
Carbon Scenario
#
Setup
To remove artifacts, run the Cleanup Scripts as from the Kali hosts. You can also run the cleanup scripts on each target as described in their respective directories.
From the Kali Linux machine (
176.59.15.33
):cd /opt/day1/turla xfreerdp +clipboard /u:skt\\\evals_domain_admin /p:"DuapQj7k8Va8U1X27rw6" /v:10.20.10.9 /drive:X,Resources/cleanup
From the RDP session, open powershell in administrative mode
Run the cleanup commands for each implant listed below that you need to cleanup
Sign out of the RDP session when finished.
#
EPIC
-
\\tsclient\X\EPIC\epic_cleanup.ps1 -target hobgoblin -user gunter
#
Carbon
-
$targethosts = "hobgoblin","bannik","khabibulin" foreach ($targethost in $targethosts) { Write-Host "[+] Performing Carbon cleanup on $targethost" Invoke-Command -ComputerName $targethost -FilePath \\tsclient\X\Carbon\carbon_cleanup.ps1 }
#
Penquin
Additional documentation here.
From the Kali Linux machine, SCP the Penquin cleanup script to KAGAROV:
cd /opt/day1/turla scp Resources/cleanup/Penquin/cleanup_penquin.sh adalwolfa@10.20.10.23:
Enter
Password2!
when prompted:Execute the cleanup script, entering
Password2!
when prompted:ssh adalwolfa@10.20.10.23 "sudo ./cleanup_penquin.sh && rm cleanup_penquin.sh"
#
Snake Scenario
#
Setup
To remove artifacts, run the Cleanup Scripts as from the Kali hosts. You can also run the cleanup scripts on each target as described in their respective directories.
From the Kali Linux machine (
176.59.15.33
):cd /opt/day2/turla xfreerdp +clipboard /u:nk\\\evals_domain_admin /p:"DuapQj7k8Va8U1X27rw6" /v:10.100.30.202 /drive:X Resources/cleanup
From the RDP session, open powershell in administrative mode and set the execution policy
Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope CurrentUser
Run the cleanup commands for each implant listed below that you need to cleanup
Reset the execution policy
Set-ExecutionPolicy -ExecutionPolicy Undefined -Scope CurrentUser
Sign out of the RDP session when finished.
#
EPIC
-
\\tsclient\X\EPIC\epic_cleanup.ps1 -target azuolas -user egle
#
Snake
-
$targethosts = "azuolas","berzas","uosis" \\tsclient\X\Snake\snake_cleanup.ps1 -targets $targethosts -restart -deleteInstaller
#
LightNeuron
-
Invoke-Command -ComputerName drebule -FileName \\tsclient\X\LightNeuron\lightneuron_cleanup.ps1