DataPhreak

Okay, so just about every guide or tutorial out there tells you to "Cover your tracks" and "Clean the logs" but never have I ever found a guide that tells you what you need to be cleaning after compromising a windows machine. If anyone has a guide on the topic, I'd love a link. Otherwise, lets assume a windows machine is compromised with meterpreter after a browser attack, we set up persistence, pass the hash, and pivot. Maybe take a shot from the webcam.

Quick bump to this topic, Trying to set this up myself. I've been looking around and can't find a guide for installing Karma manually and configuring. Presumably it's going to be something like this: cd ~ wget http://www.digininja.org/files/hostapd-karma.tar_0.1.tar.bz2 tar -jcvf hostapd-karma.tar_0.1.tar.bz2 cd hostapd-karma ./config make nano hostapd-karma.conf #edit config file ./hostapd -dd ~/hostapd-karma.conf Seems too simple though. I'm sure I'm missing some steps here. Also, some questions: 1. Does this, with the propper .conf settings, provide the same functionality as airbase-ng's -P mode that accepts all probes? 2. Does Karma provide DHCP and DNS servers, or is it just for getting clients to authenticate to the device? (I'm wanting to do a custom setup, so the latter is prefferable.) 3. Is this the most up to date version of Karma and Hostapd? Or does that need to be installed with apt-get? Dependencies? 4. Will computers set to automatically connect to WPA2/AES clients connect and use this network, or will it only capture the handshake and the remote client disconnect? 5. Digininja, Y U NO have guide on karma page? ლ(ಠ益ಠლ) Again, if there is a guide out there explaining all of this, shoot me a link, please. If I can get this up and working, I might just document the process and post it for review. Using Backtrack 5r2 with an Alfa AWUS036NHR, btw. It uses the realtek rtl9182(se or cu suffix, can't remember which and don't have it with me to check), but supports injection, not sure if it supports master mode. Thanks in advance, guys.