Meterpreter

Meterpreter

Specialized shell that runs on memory (AV Evasion) and encrypts traffic communication with the server Metasploit runs.

PROTIP: Run help command to find the appropriate at the time command to use.

POST EXPLOITATION WITH METERPRETER

1)

Help

2)

Getuid

3)

Getpid

4)

ps

5) (Depending on the process to migrate, we can use key_scan start/stop/dump (word.exe,notepad.exe) to utilize some meterpreter commands) (Privesc/Privdeesc)

migrate 

6) (List SAM Database content) (Windows) (Pash-the-Hash/Rainbow Table attacks)

Hashdump 

7) (Search flags in CTF, configuration or user-generated files in penetration testing engagements)

Search -f FILE 

8) (CTRL + Z to get back to meterpreter)

Shell 

PROTIP: We can use load command to load tools that give meterpreter extra functionality (mimikatz: load kiwi)