Commands

Typing help on any Meterpreter session (shown by meterpreter> at the prompt) will list all available commands.

meterpreter > help

Core Commands
=============

    Command                   Description
    -------                   -----------
    ?                         Help menu
    background                Backgrounds the current session
    bg                        Alias for background
    bgkill                    Kills a background meterpreter script
    bglist                    Lists running background scripts
    bgrun                     Executes a meterpreter script as a background thread
    channel                   Displays information or control active channels
    close                     Closes a channel[...]

Every version of Meterpreter will have different command options, so running the help command is always a good idea. Commands are built-in tools available on Meterpreter. They will run on the target system without loading any additional script or executable files.

Meterpreter will provide you with three primary categories of tools;

• Built-in commands

• Meterpreter tools

• Meterpreter scripting

If you run the help command, you will see Meterpreter commands are listed under different categories.

• Core commands

• File system commands

• Networking commands

• System commands

• User interface commands

• Webcam commands

• Audio output commands

• Elevate commands

• Password database commands

• Timestomp commands

Please note that the list above was taken from the output of the help command on the Windows version of Meterpreter (windows/x64/meterpreter/reverse_tcp). These will be different for other Meterpreter versions.

Meterpreter commands

Core commands will be helpful to navigate and interact with the target system. Below are some of the most commonly used. Remember to check all available commands running the help command once a Meterpreter session has started.

Core commands

• background: Backgrounds the current session

• exit: Terminate the Meterpreter session

• guid: Get the session GUID (Globally Unique Identifier)

• help: Displays the help menu

• info: Displays information about a Post module

• irb: Opens an interactive Ruby shell on the current session

• load: Loads one or more Meterpreter extensions

• migrate: Allows you to migrate Meterpreter to another process

• run: Executes a Meterpreter script or Post module

• sessions: Quickly switch to another session

File system commands

• cd: Will change directory

• ls: Will list files in the current directory (dir will also work)

• pwd: Prints the current working directory

• edit: will allow you to edit a file

• cat: Will show the contents of a file to the screen

• rm: Will delete the specified file

• search: Will search for files

• upload: Will upload a file or directory

• download: Will download a file or directory

Networking commands

• arp: Displays the host ARP (Address Resolution Protocol) cache

• ifconfig: Displays network interfaces available on the target system

• netstat: Displays the network connections

• portfwd: Forwards a local port to a remote service

• route: Allows you to view and modify the routing table

System commands

• clearev: Clears the event logs

• execute: Executes a command

• getpid: Shows the current process identifier

• getuid: Shows the user that Meterpreter is running as

• kill: Terminates a process

• pkill: Terminates processes by name

• ps: Lists running processes

• reboot: Reboots the remote computer

• shell: Drops into a system command shell

• shutdown: Shuts down the remote computer

• sysinfo: Gets information about the remote system, such as OS

Others Commands (these will be listed under different menu categories in the help menu)

• idletime: Returns the number of seconds the remote user has been idle

• keyscan_dump: Dumps the keystroke buffer

• keyscan_start: Starts capturing keystrokes

• keyscan_stop: Stops capturing keystrokes

• screenshare: Allows you to watch the remote user's desktop in real time

• screenshot: Grabs a screenshot of the interactive desktop

• record_mic: Records audio from the default microphone for X seconds

• webcam_chat: Starts a video chat

• webcam_list: Lists webcams

• webcam_snap: Takes a snapshot from the specified webcam

• webcam_stream: Plays a video stream from the specified webcam

• getsystem: Attempts to elevate your privilege to that of local system

• hashdump: Dumps the contents of the SAM database

Although all these commands may seem available under the help menu, they may not all work. For example, the target system might not have a webcam, or it can be running on a virtual machine without a proper desktop environment.

---

Migrate

Migrating to another process will help Meterpreter interact with it. For example, if you see a word processor running on the target (e.g. word.exe, notepad.exe, etc.), you can migrate to it and start capturing keystrokes sent by the user to this process. Some Meterpreter versions will offer you the keyscan_start, keyscan_stop, and keyscan_dump command options to make Meterpreter act like a keylogger. Migrating to another process may also help you to have a more stable Meterpreter session.

To migrate to any process, you need to type the migrate command followed by the PID of the desired target process. The example below shows Meterpreter migrating to process ID 716.

The migrate command

meterpreter > migrate 716
[*] Migrating from 1304 to 716...
[*] Migration completed successfully.
meterpreter >

Be careful; you may lose your user privileges if you migrate from a higher privileged (e.g. SYSTEM) user to a process started by a lower privileged user (e.g. webserver). You may not be able to gain them back.

Hashdump

The hashdump command will list the content of the SAM database. The SAM (Security Account Manager) database stores user's passwords on Windows systems. These passwords are stored in the NTLM (New Technology LAN Manager) format.

The hashdump command

meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Jon:1000:aad3b435b51404eeaad3b435b51404ee:ffb43f0de35be4d9917ac0cc8ad57f8d:::
meterpreter >

While it is not mathematically possible to "crack" these hashes, you may still discover the cleartext password using online NTLM databases or a rainbow table attack. These hashes can also be used in Pass-the-Hash attacks to authenticate to other systems that these users can access the same network.

Search

The search command is useful to locate files with potentially juicy information. In a CTF context, this can be used to quickly find a flag or proof file, while in actual penetration testing engagements, you may need to search for user-generated files or configuration files that may contain password or account information.

The search command

meterpreter > search -f flag2.txt
Found 1 result...
    c:\Windows\System32\config\flag2.txt (34 bytes)
meterpreter >

Shell

The shell command will launch a regular command-line shell on the target system. Pressing CTRL+Z will help you go back to the Meterpreter shell.

The shell command

meterpreter > shell
Process 2124 created.
Channel 1 created.
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>