- by x32x01 ||
Meterpreter Useful Top 60 Commands List
Meterpreter is an advanced, dynamically extensible payload that uses in-memory DLL injection stagers and is extended over the network at runtime. It communicates over the stager socket and provides a comprehensive client-side Ruby API.How Meterpreter Works
- The target executes the initial stager. This is usually one of bind, reverse, findtag, passivex, etc.
- The stager loads the DLL prefixed with Reflective. The Reflective stub handles the loading/injection of the DLL.
- The Metepreter core initializes, establishes a TLS/1.0 link over the socket and sends a GET. Metasploit receives this GET and configures the client.
- Lastly, Meterpreter loads extensions. It will always load stdapi and will load priv if the module gives administrative rights. All of these extensions are loaded over TLS/1.0 using a TLV protocol.
- Background the current session – background
- Kill a background meterpreter session – bgkill
- Displays info about active channels – channel
- Close a channel – close
- Disables encoding of unicode strings – disable_unicode_encoding
- Enable encoding of unicode strings – enable_unicode_encoding
- Exit meterpreter shell – exit
- Display info about active post module – info
- Interact with a channel – interact
- Drop into irb scripting mode – irb
- Load one or more meterpreter extensions – load
- Migrate the server to another – migrate
- Terminate the meterpreter sessions – quit
- Reads data from a channel – read
- Run the commands stored in a file – resource
- Executes a meterpreter script or post module – run
- Write data to a channel – write
- Read the contents of a file to the screen – cat
- Change directory – cd
- Download file to your system – download
- Edit a file – edit
- Print local working directory – getlwd
- Print working directory – getwd
- Change local working directory – lcd
- Print local working directory – lpwd
- List files – ls
- Make directory – mkdir
- Print working directory – pwd
- Delete the speficied file – rm
- Remove directory – rmdir
- Search for files – search
- Upload file to target – upload
- Get the current meterpreter desktop – getdesktop
- Display the amoung of time the user has been idle – idletime
- Start capturing keystrokes – keyscan_start
- Stop capturing keystrokes – keyscan_stop
- Dump the keystroke buffer – keyscan_dump
- Screenshot of the GUI – screenshot
- Change the meterpreters current desktop – setdesktop
- Control some of the user interface components – uictl
- List webcams – webcam_list
- Take a snapshot from the specified webcam – webcam_snap
- Attempt to elevate your priviledge to that of local system – getsystem
- Dumps the contents of the SAM database – hashdump
- Manipulate MACE attributes – timestop
- Clear the event log – clearev
- Relinquishes any active impersonation token – drop_token
- Execute a command – execute
- Get the current process identifier – getpid
- Attempt to enable all privileges available to the current process – getprivs
- Get the user that the server is running as – getuid
- Terminate a process – kill
- List running processes – ps
- Reboots the remote computer – reboot
- Interact with remote registry – reg
- Calls RevertToSelf() on the remote machine – rev2self
- Drop into a system command shell – shell
- Shuts down the remote computer – shutdown
- Attempt to steal an Impersonation token from the process – steal_token
- Gets information about the remote system – sysinfo