# Clean Up

Cleaning up after a security assessment or penetration testing engagement is a critical step to ensure that the system or network is restored to its original state. Here's a general guide on how to clean up after an ethical hacking activity:

1. **Remove Added Files and Directories:**
   * Identify and delete any files, directories, or executables that were added during the testing.
   * Use commands like `rm` (Linux) or `del` (Windows) to delete files and directories.
2. **Remove User Accounts:**
   * If any additional user accounts were created for testing, delete them.
   * On Linux, use the `userdel` command: `sudo userdel <username>`.
   * On Windows, use the `net user` command: `net user <username> /delete`.
3. **Revert Configurations:**
   * Restore modified configurations to their original state.
   * Use backup configurations or system snapshots if available.
4. **Remove Malware and Rootkits:**
   * Run a comprehensive antivirus or anti-malware scan on the system.
   * Use reputable security tools to detect and remove any malware or rootkits that might have been introduced.
5. **Revert System Settings:**
   * Revert any changes made to system settings or configurations during the testing.
   * Review and reset firewall rules, network configurations, and other system parameters.
6. **Remove Persistent Mechanisms:**
   * If any persistence mechanisms were established (e.g., scheduled tasks, registry entries), remove them.
   * Use the same methods employed during the testing to establish persistence.
7. **Validate Changes:**
   * Validate that the changes made during the testing have been successfully reverted.
   * Confirm that the system is functioning normally and that no unauthorized changes remain.
8. **Documentation:**
   * Document the cleanup process, including the files deleted, configurations reverted, and accounts removed.
   * This documentation can be essential for future reference, compliance, or auditing purposes.
9. **Communication:**
   * If the testing was conducted in collaboration with the system administrators or IT team, communicate the completion of the testing and cleanup.
10. **Post-Assessment Review:**
    * Conduct a post-assessment review to analyze the testing process, identify lessons learned, and improve future engagements.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://sallam.gitbook.io/sec-88/network-sec/post-exploitation/clean-up.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.