‫So another important thing to remember is it's vital to remove the back door once you put a back door
‫on a system, anyone can use that back door to compromise the system.
‫Of course, there are some methods to prevent unintended usages of a back door, but still.
‫You have to remove the back door when you finish with it.
‫There are two plus one steps to remove the back door we put in the previous lecture.
‫Now, in the first step, we're going to remove the back door within the interpreter session.
‫Now, as you know, there are different filesystem commands, interpretor that you can use on the remote
‫host and one of them is R.M., which is used to remove the specified file.
‫Now, the R.M. commands need the full file name, so let's roll up to find the installed file path and
‫the name.
‫Here are the messages of the persistance command and here is the file and the full pat.
‫So as you imagine, the path is different from the previous lecture, because this is another back door
‫that I created off the record.
‫So no matter what.
‫Just find the back door file and its location.
‫Now, let me find the file in the victim machine documents and settings, Administrator Dalziell to
‫local settings temp.
‫This is the file.
‫So I'll copy the full file path.
‫And give it the perimeter of the R.M. command.
‫Now, don't forget to duplicate the back slashes.
‫As I mentioned before, the first backslash is the indicator of a special character, and the second
‫one is that special character.
‫Now it says that the access is denied.
‫So maybe I don't have the necessary rights, so I'll want to use get system interpreter command to gain
‫the system privileges.
‫So I got the system.
‫Now, try to delete the file again.
‫Oh, my mistake.
‫I put the path but didn't put the file name.
‫So now I copy the file name and pasted at the end of the path.
‫OK, the file is now deleted.
‫So the first step is pretty much enough to destroy the back door, but, you know, it's better to be
‫safe than sorry, so let's just clean the system.
‫So I'd like to delete the registry key that is created by the persistence method.
‫Roll up to find their created register key.
‫Here, I'll copy the full path and name, so we're going to use the Regg command to delete the registry
‫key when we type Regg and hit enter.
‫We reached the help page of the command.
‫Well, I made millions of unsuccessful attempts.
‫I don't want to lead these attempts just to show you that you shouldn't give up easily to succeed.
‫OK, so here's the correct Vrej Command to delete a key is Reg.
‫They'll let eval take the full path of the key, the the name of the key.
‫I think we finally deleted the registry key.
‫So let's go to the victim's system and just check to make sure it's deleted, refresh the registry,
‫Ed, and yeah, the key has gone.
‫So the next step is not related to the victim machine.
‫I just wanted to clean up my own system, Carly.
‫So when I run the persistence method, a folder's created to keep the logs of that persistent session,
‫so let's delete the folder for perfect cleaning.
‫I now open a new terminal screen, I'm in the home folder of the current user route.
‫She held to see all the files and folders, including the hidden ones.
‫Now, there is a folder named MSF for Use the CD command to go inside that folder.
‫Now go to the logs folder, there is a folder called Persistance in it, go to that folder as well.
‫As you see, there's a folder here, the first part of the folder is the domain name of our victim machine
‫and the rest is the date and time of the first usage of the persistance method.
‫So here you can use the R.M. command with RF as the parameter to delete any non-empty folder, and that's
‫a.