Hello everyone. In this video. We're going to be taking a look at
how to clear event logs on Windows. Now again, when
we talk about post exploitation, an important factor
in post exploitation is clearing your tracks and
because we're dealing with Windows, we dealing
with the Windows operating system. We have to
talk about the event log and the Event Viewer.
So if we go into the our Windows VM, and we're using the
Windows 10 p.m. Now, and we search for The Event
Viewer, The Event Viewer is an application that
Allows Windows users to view a logs of their
system. And essentially, the logs are sorted out
in terms of application security. So it
essentially gives a user of a window system. The ability to
view all all events that were
that actually took place on the system, which again can
indicate potential compromise, right? So this
is something that you want to clear after a particular
exploitation or post exploitation, where
you elevated privileges. So if we take a look at the security,
Pretty logs right over here. You can see that we
have something really curious here. So I'll
just go back to the top to the latest ones right
over here. This was on the 16th. And
this was an audit success. Right? So this again
tells us there's an audit success, which means there's a log on. And
in this case you can see it tells us there's a special log on. Now
the thing with this log on, this is not a regular log on
as you would expect and you can see that we have multiple logins
and this was us essentially.
With multiple meterpreter sessions. Now.
The interesting thing about this special log on is that you can see the
security ID, set to system and the account. Domain is anti-authority,
of course, but in terms of the Privileges, you
can see, we have all the Privileges that have
been assigned here, which again given that this is a
special log on, should not be the case. And again, another
important thing is, we haven't even logged
onto the to the admin account
on Windows. We are currently logged in.
In as the currently logged in as the Windows
10 user again. So I can actually just show
you again again, show that to you here, if I
can just list the user account that we're currently logged in, as if
I go into my PC and it properties we
are currently logged in as the we're currently logged in
as the Windows 10 user. So again, I can just,
I'll show you that in a second, but you can see that we
have all of these special log, ons that are all the
are all using the account.
Domain and the authority, and essentially, using
the administrative, the
administrative user or the admin user. Again.
We have a special log on for the regular log on, you
can see the account name is desktop and listed
out that that is the Windows 10 user. So that is perfectly
fine. And
again, you can go through all of these, all of
these event logs, and these are just security logs. If you take a look at the application
logs. We have various application logs.
That you can look at, but all of this information can actually
tell a user that the system has been compromised. So
how do we clear all of this information? So what we're going
to do is we'll go back into the meterpreter session right over
here and we have an inbuilt tool with meterpreter clothes.
And again, I'll just take the I'll take you to that particular tool here. A
really fantastic tool that clears all of this out
for us. So again, I'll just take
you to that and there we are. It's called clear easy
or clear event log.
And essentially, what this does, is it clears, the entire event event
log and again, a user. If
they, if they try and view the event log, they'll be literally
nothing. And again, that will indicate to
a certain extent that there isn't anything suspicious happening. So
all we need to do is type in clear EV and
we hit enter and there we are. You
can see it's wiping 692 records from the application. It's
wiping 1396 records from
system and more importantly, it's wiping 32.
68 records from security. So we can confirm this
by going into the Event Viewer, and I'll just open
it again. So, we say, Event Viewer, and there
we go, and we'll click on Windows logs. We
click on application empty. We click on security, and
we still have one here. And these are
the late. These are from 2015. So you can see,
we have no latest ones. These all, from the sorry, no,
from 2015, but the 15th of September, as you can see,
we are currently. If I open this up here.
These are all these are just other system events that have nothing
to do with potential exploitation. And
again, you can see that this was to do
with the then we export of
the persistent cryptographic key. And again, this has nothing to
do with any log on of any soft and you can see we have
the log clear, command, that was actually executed. And
that was done using the user account int
Authority. Which again, could be a potential issue. But
again, you're clearing all the other logs.
That might that might indicate potential potential
compromise or that might reveal information about
the attacker and what they were doing on the system. So the
clear EV command with meterpreter is
very very useful at clearing your tracks on the system. And
again, this concludes the
post exploitation phase of the course. I
hope you learned a lot in this. So in this section, we've
covered a lot of various privilege, escalation techniques,
and we've also taken a look at how to maintain
Auto maintain persistence on the system. And now,
we've taken a look at how to clear the all the
event logs on Windows using the clear EV command with
meterpreter. So that's going to be it for this video. And we'll be seeing you
in the next module.