Cleanup

This covers cleaning up files or settings left on the target. Even in a test environment, it is safer to be able to remove what you placed there.

FileDropper

include Msf::Exploit::FileDropper

def exploit
  remote = '/tmp/' + Rex::Text.rand_text_alpha(8)
  # ... upload ...
  register_file_for_cleanup(remote)
  # ... execute ...
end

API	Purpose
register_file_for_cleanup(path)	File
register_files_for_cleanup(*paths)	Multiple files
register_dir_for_cleanup(path)	Directory

It attempts to delete them after a session is acquired or when the module finishes. Cleanup can fail, so record the paths in notes. See FileDropper for details.

The module’s own cleanup

def cleanup
  disconnect if respond_to?(:disconnect)
  super
end

If you opened connections or temporary jobs yourself, close them here. Do not forget super.

Configuration changes

FileDropper alone is not enough for admin / manage operations such as adding accounts or changing cron.

• State what will change in Description.
• Where possible, document an action or steps to delete or revert the change in the module or documentation.
• Add CONFIG_CHANGES or similar to SideEffects.

Verify after running

# After running the module
loot
notes
sessions -l
jobs -l

Track files placed by your own scripts under the ~/lab policy too.