modules/post/chapter-10/CleanTracks.rb
def ls_revert
  # list of arrays to be executed
  default = [
   'REG ADD "HKLM\\System\\CurrentControlSet\\services\\WSearch" /v start /t REG_DWORD /d 2 /f',
   'REG ADD "HKLM\\System\\CurrentControlSet\\Control\\Update" /v UpdateMode /t REG_DWORD /d 0 /f',
   'REG ADD "HKLM\\Software\\Microsoft\\Security Center" /v FirewallDisableNotify /t REG_DWORD /d 0 /f',
   'REG ADD "HKLM\\Software\\Microsoft\\Security Center" /v AntiVirusDisableNotify /t REG_DWORD /d 0 /f',
   'REG ADD "HKLM\\Software\\Policies\\Microsoft\\Windows\NetCache" /v PurgeAtLogoff /t REG_DWORD /d 0 /f',
   'REG ADD "HKLM\\System\\CurrentControlSet\\Control\\FileSystem" /v NtfsDisableLastAccessUpdate /t REG_DWORD /d 0 /f',
   'REG ADD "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Comdlg32" /v NoFileMRU /t REG_DWORD /d 0 /f',
   'REG ADD "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" /v NoInstrumentation /t REG_DWORD /d 0 /f',
   'REG ADD "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" /v NoRecentDocsHistory /t REG_DWORD /d 0 /f',
   'REG ADD "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" /v ClearRecentDocsOnExit /t REG_DWORD /d 0 /f',
   'REG ADD "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" /v EnableInstallerDetection /t REG_DWORD /d 1 /f',
   'REG ADD "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" /v NoStartMenuMFUprogramsList /t REG_DWORD /d 0 /f',
   'REG ADD "HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\Memory Management" /v ClearPageFileATShutdown /t REG_SZ /d 0 /f',
   'REG ADD "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\internet Settings\\Url History" /v DaysToKeep /t REG_DWORD /d 15 /f',
   'REG ADD "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Cache" /v Persistent  /t REG_DWORD /d 1 /f',
   'RUNDLL32.EXE USER32.DLL,UpdatePerUserSystemParameters ,1 ,True'
  ]
 
        r=''
        print_line("")
        # executing list of arrays on target system and display info on screen
        print_line("    Reverts all registry policies keys changed")
        print_line("    by (PREVENT) option to there default values!")
        print_line("    ------------------------------------------")
        session.response_timeout=120
        default.each do |cmd|
                begin
                  # execute cmd prompt in a hidden channelized windows
                  r = session.sys.process.execute("cmd.exe /c #{cmd}", nil, {'Hidden' => true, 'Channelized' => true})
                  print_line("    exec => #{cmd}")
 
                     # close client channel when done
                     while(d = r.channel.read)
                             break if d == ""
                     end
                     r.channel.close
                     r.close
                 # error exception funtion
                 rescue ::Exception => e
                  print_error(" Error Running Command: #{e.class} #{e}")
                  print_error(" Try to rise meterpreter session to [nt authority/system] before runing this module")
                end
        end
        # print display on screen
        print_line("    ------------------------------------------")
        print_line("    Target system its now logging activity again!")
        print_line("")
 end
# ---------------------------------------------------- 
# REVERT - REVERT POLICIES (prevent) TO DEFAULT VALUES
# ----------------------------------------------------
REVERT POLICIES (prevent) TO DEFAULT VALUES
REVERT POLICIES ( prevent ) TO DEFAULT VALUES
def ls_revert
  default = [
   'REG ADD "HKLM\\System\\CurrentControlSet\\services\\WSearch" /v start /t REG_DWORD /d 2 /f',
   'REG ADD "HKLM\\System\\CurrentControlSet\\Control\\Update" /v UpdateMode /t REG_DWORD /d 0 /f',
   'REG ADD "HKLM\\Software\\Microsoft\\Security Center" /v FirewallDisableNotify /t REG_DWORD /d 0 /f',
   'REG ADD "HKLM\\Software\\Microsoft\\Security Center" /v AntiVirusDisableNotify /t REG_DWORD /d 0 /f',
   'REG ADD "HKLM\\Software\\Policies\\Microsoft\\Windows\NetCache" /v PurgeAtLogoff /t REG_DWORD /d 0 /f',
   'REG ADD "HKLM\\System\\CurrentControlSet\\Control\\FileSystem" /v NtfsDisableLastAccessUpdate /t REG_DWORD /d 0 /f',
   'REG ADD "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Comdlg32" /v NoFileMRU /t REG_DWORD /d 0 /f',
   'REG ADD "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" /v NoInstrumentation /t REG_DWORD /d 0 /f',
   'REG ADD "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" /v NoRecentDocsHistory /t REG_DWORD /d 0 /f',
   'REG ADD "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" /v ClearRecentDocsOnExit /t REG_DWORD /d 0 /f',
   'REG ADD "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" /v EnableInstallerDetection /t REG_DWORD /d 1 /f',
   'REG ADD "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" /v NoStartMenuMFUprogramsList /t REG_DWORD /d 0 /f',
   'REG ADD "HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\Memory Management" /v ClearPageFileATShutdown /t REG_SZ /d 0 /f',
   'REG ADD "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\internet Settings\\Url History" /v DaysToKeep /t REG_DWORD /d 15 /f',
   'REG ADD "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Cache" /v Persistent  /t REG_DWORD /d 1 /f',
   'RUNDLL32.EXE USER32.DLL,UpdatePerUserSystemParameters ,1 ,True'
  ]
        r=''
        print_line("")
        print_line("    Reverts all registry policies keys changed")
        print_line("    by (PREVENT) option to there default values!")
        print_line("    ------------------------------------------")
        session.response_timeout=120
        default.each do |cmd|
                begin
                  r = session.sys.process.execute("cmd.exe /c #{cmd}", nil, {'Hidden' => true, 'Channelized' => true})
                  print_line("    exec => #{cmd}")
                     while(d = r.channel.read)
                             break if d == ""
                     end
                     r.channel.close
                     r.close
                 rescue ::Exception => e
                  print_error(" Error Running Command: #{e.class} #{e}")
                  print_error(" Try to rise meterpreter session to [nt authority/system] before runing this module")
                end
        end
        print_line("    ------------------------------------------")
        print_line("    Target system its now logging activity again!")
        print_line("")
 end
def ls_revert default = [ 'REG ADD "HKLM\\System\\CurrentControlSet\\services\\WSearch" /v start /t REG_DWORD /d 2 /f' , 'REG ADD "HKLM\\System\\CurrentControlSet\\Control\\Update" /v UpdateMode /t REG_DWORD /d 0 /f' , 'REG ADD "HKLM\\Software\\Microsoft\\Security Center" /v FirewallDisableNotify /t REG_DWORD /d 0 /f' , 'REG ADD "HKLM\\Software\\Microsoft\\Security Center" /v AntiVirusDisableNotify /t REG_DWORD /d 0 /f' , 'REG ADD "HKLM\\Software\\Policies\\Microsoft\\Windows\NetCache" /v PurgeAtLogoff /t REG_DWORD /d 0 /f' , 'REG ADD "HKLM\\System\\CurrentControlSet\\Control\\FileSystem" /v NtfsDisableLastAccessUpdate /t REG_DWORD /d 0 /f' , 'REG ADD "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Comdlg32" /v NoFileMRU /t REG_DWORD /d 0 /f' , 'REG ADD "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" /v NoInstrumentation /t REG_DWORD /d 0 /f' , 'REG ADD "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" /v NoRecentDocsHistory /t REG_DWORD /d 0 /f' , 'REG ADD "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" /v ClearRecentDocsOnExit /t REG_DWORD /d 0 /f' , 'REG ADD "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" /v EnableInstallerDetection /t REG_DWORD /d 1 /f' , 'REG ADD "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" /v NoStartMenuMFUprogramsList /t REG_DWORD /d 0 /f' , 'REG ADD "HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\Memory Management" /v ClearPageFileATShutdown /t REG_SZ /d 0 /f' , 'REG ADD "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\internet Settings\\Url History" /v DaysToKeep /t REG_DWORD /d 15 /f' , 'REG ADD "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Cache" /v Persistent  /t REG_DWORD /d 1 /f' , 'RUNDLL32.EXE USER32.DLL,UpdatePerUserSystemParameters ,1 ,True' ] r = '' print_line ( "" ) print_line ( "    Reverts all registry policies keys changed" ) print_line ( "    by (PREVENT) option to there default values!" ) print_line ( "    ------------------------------------------" ) session . response_timeout = 120 default . each do | cmd | begin r = session . sys . process . execute ( "cmd.exe /c #{cmd}" , nil , { 'Hidden' => true , 'Channelized' => true } ) print_line ( "    exec => #{cmd}" ) while ( d = r . channel . read ) break if d == "" end r . channel . close r . close rescue :: Exception => e print_error ( " Error Running Command: #{e.class} #{e}" ) print_error ( " Try to rise meterpreter session to [nt authority/system] before runing this module" ) end end print_line ( "    ------------------------------------------" ) print_line ( "    Target system its now logging activity again!" ) print_line ( "" ) end
REVERT - REVERT POLICIES (prevent) TO DEFAULT VALUES
REVERT - REVERT POLICIES ( prevent ) TO DEFAULT VALUES
# list of arrays to be executed # executing list of arrays on target system and display info on screen # execute cmd prompt in a hidden channelized windows # close client channel when done # error exception funtion # print display on screen