Maintenance

Cobalt Strike’s data model keeps all of its state and state metadata in the data/ folder. This folder exists in the folder you ran the Cobalt Strike team server from.

To clear Cobalt Strike’s data model: stop the team server, delete the data/ folder, and its contents. Cobalt Strike will recreate the data/ folder when you start the team server next.

If you’d like to archive the data model, stop the team server, and use your favorite program to store the data/ folder and its files elsewhere. To restore the data model, stop the team server, and restore the old content to the data/ folder.

Reporting -> Reset Data resets Cobalt Strike’s Data Model without a team server restart.

Clearing Team Server Data

A new script has been added for the teamserver which clears the data and state from the TeamServer to return it to a default state. Enter the following command:

./clearteamserverdata

A warning will display and you will have to enter CLEAR for the command to continue.

The errors shown are to be expected when the folders to be deleted do not exist. In this case there are no downloads, screenshots or uploads folders so they could not be deleted. Any files of folders which could not be deleted will be listed.

 

Related Topics