pentest-cleanup

/pentest-cleanup — Engagement Cleanup

Generate a cleanup checklist for engagement end. Parse activity log to identify every artifact deployed on target systems — tools uploaded, persistence mechanisms, accounts created, tunnels, web shells. Produce checklist with removal + verification commands. You do NOT execute any removal commands.

---

Step 1: Resolve Active Engagement

Use the Bash tool to read the active engagement pointer and extract required fields:

# --- Engagement Resolver ---
ENGAGEMENT_JSON=$(cat ~/.pentest/active-engagement 2>/dev/null)

if [ -z "$ENGAGEMENT_JSON" ]; then
  echo "No active engagement found. Run /pentest-init or /pentest-switch." >&2
  exit 1
fi

if [ ! -f "$ENGAGEMENT_JSON" ]; then
  echo "Active engagement path '$ENGAGEMENT_JSON' does not exist. Run /pentest-switch." >&2
  exit 1
fi

ENGAGEMENT_ID=$(jq -r '.engagement_id' "$ENGAGEMENT_JSON")
OUTPUT_DIR=$(jq -r '.output_dir' "$ENGAGEMENT_JSON")
TESTER=$(whoami)

TESTER_MATCH=$(jq -r --arg h "$TESTER" '.testers[] | select(.handle == $h) | .handle' "$ENGAGEMENT_JSON")
if [ -z "$TESTER_MATCH" ]; then
  echo "Operator '$TESTER' is not registered on this engagement." >&2
  exit 1
fi
# --- End Engagement Resolver ---

After this block, $ENGAGEMENT_ID, $OUTPUT_DIR, and $TESTER are guaranteed to be set and valid.

---

Step 2: Parse Activity Log for Artifacts

Use the Bash tool to extract all completed exploit and post-exploit entries from the activity log:

jq -r 'select(.action == "post_exploit" or .action == "exploit") | select(.status == "completed") | [.ts, .tester, .action, .target, .tool, .command] | @csv' "${OUTPUT_DIR}/activity.log"

Also read the loot directory index if present — some tool deployments are only traceable from loot entries (e.g., an LSASS dump implies procdump was uploaded):

ls -1 "${OUTPUT_DIR}/loot/" 2>/dev/null

For each log entry returned, classify the artifact using the following signal table:

Activity Log Signal	Artifact Type
action == "exploit" and tool contains shell or webshell	Web shell
action == "post_exploit" and tool contains chisel, ligolo, socat, or ssh	Tunnel/proxy
action == "post_exploit" and details or command mentions persistence, cron, schtask, service, or registry	Persistence
action == "post_exploit" and details or command mentions upload, transfer, or push	Tool uploaded
action == "exploit" and details or command mentions account, user, or addcomputer	Account created
action == "post_exploit" and details or command mentions firewall, iptables, or netsh	Firewall change