Meterpreter Basics
Meterpreter Basics
Core Commands
=============
Command Description
------- -----------
? Help menu
background Backgrounds the current session
channel Displays information about active channels
...snip...
background
a11y.text background
The background command will send the current Meterpreter session to the background
and return you to the ‘msf’ prompt. To get back to your Meterpreter session, just interact
with it again.
meterpreter >
cat
a11y.text cat
The cat command is identical to the command found on *nix systems. It displays the
content of a file when it’s given as an argument.
Example usage:
meterpreter > cat edit.txt
What you talkin' about Willis
meterpreter >
cd and pwd
a11y.text cd and pwd
The cd and pwd commands are used to change and display current working directly on
the target host. The change directory “cd” works the same way as it does under DOS and
*nix systems. By default, the current working folder is where the connection to your
listener was initiated.
ARGUMENTS:
Example usuage:
clearev
a11y.text clearev
The clearev command will clear the Application, System, and Security logs on
a Windows system. There are no options or arguments.
Before using Meterpreter to clear the logs | Metasploit Unleashed
After
download
a11y.text download
The download command downloads a file from the remote machine. Note the use of the
double-slashes when giving the Windows path.
edit
a11y.text edit
The edit command opens a file located on the target host. It uses the ‘vim’ so all the
editor’s commands are available.
Example usage:
meterpreter > ls
Please refer to the vim editor documentation for more advance use. http://www.vim.org/
execute
a11y.text execute
The execute command runs a command on the target.
C:\WINDOWS\system32>
getuid
a11y.text getuid
Running getuid will display the user that the Meterpreter server is running as on the host.
hashdump
a11y.text hashdump
The hashdump post module will dump the contents of the SAM database.
Administrator:500:b512c1f3a8c0e7241aa818381e4e751b:1891f4775f676d4d10c09c1225a5c0a3:::
dook:1004:81cbcef8a9af93bbaad3b435b51404ee:231cbdae13ed5abd30ac94ddeb3cf52d:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
HelpAssistant:1000:9cac9c4683494017a0f5cad22110dbdc:31dcf7f8f9a6b5f69b9fd01502e6261e::
:
SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:36547c5a8a3de7d422a026e51097ccc
9:::
victim:1003:81cbcea8a9af93bbaad3b435b51404ee:561cbdae13ed5abd30aa94ddeb3cf52d:::
meterpreter >
idletime
a11y.text idletime
Running idletime will display the number of seconds that the user at the remote machine
has been idle.
meterpreter >
ARGUMENTS:
Example usage:
ls
a11y.text ls
As in Linux, the ls command will list the files in the current remote directory.
meterpreter > ls
migrate
a11y.text migrate
Using the migrate post module, you can migrate to another process on the victim.
meterpreter > ps
Process list
============
resource
a11y.text resource
The resource command will execute Meterpreter instructions located inside a text file.
Containing one entry per line, resource will execute each line in sequence. This can help
automate repetitive actions performed by a user.
By default, the commands will run in the current working directory (on target machine)
and resource file in the local working directory (the attacking machine).
ARGUMENTS:
search
a11y.text search
The search commands provides a way of locating specific files on the target host. The
command is capable of searching through the whole system or specific folders. Wildcards
can also be used when creating the file pattern to search for.
Example usage:
shell
a11y.text shell
The shell command will present you with a standard shell on the target system.
C:\WINDOWS\system32>
upload
a11y.text upload
As with the download command, you need to use double-slashes with
the upload command.
Example usage:
webcam_snap
a11y.text webcam_snap
The webcam_snap’ command grabs a picture from a connected web cam on the target
system, and saves it to disc as a JPEG image. By default, the save location is the local
current working directory with a randomized filename.
OPTIONS:
-h Help Banner
-i The index of the webcam to use (Default: 1)
-p The JPEG image path (Default: 'gnFjTnzi.jpeg')
-q The JPEG image quality (Default: '50')
-v Automatically view the JPEG image (Default: 'true')
meterpreter >
OPTIONS:
Example usage: