Chapter 1
Engagement Management
Course: Comptia Pentest Pt0 003
Subject: Comptia Pentest Plus
Chapter: Post Exploitation And Lateral Movement
After a security assessment, penetration test, or cyberattack, it is essential to remove any unauthorized modifications, persistence mechanisms, or credentials that could allow unauthorized re-entry. These steps help restore system integrity and maintain operational security.
1. Remove Persistence Mechanisms
Attackers and penetration testers often establish persistence to maintain unauthorized access to compromised systems. These persistence mechanisms allow them to regain access even after reboots or security patches.
Technical Details
- Backdoor accounts and scheduled tasks: Attackers create hidden user accounts or use Windows Task Scheduler to run malicious scripts.
- Registry modifications: On Windows, attackers modify registry keys to launch scripts on startup. bash reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v MaliciousKey /f
- Startup folder injections: Attackers place malicious scripts in startup directories. vbnet C:\Users\Public\Start Menu\Programs\Startup\backdoor.bat
- Service and daemon manipulation: On Linux, attackers create cron jobs or modify systemd services. perl crontab -l | grep -i "malicious_script.sh" crontab -r arduino systemctl stop malicious_service systemctl disable malicious_service