Meterpreter is a post‑exploitation tool included with the
Metasploit Framework that leverages access to the target system to
provide a command‑line interface and a suite of exploration and
system manipulation functionality.
Meterpreter is a payload that is configured along with the exploit module.
As we just discussed payload types,
there are singles, or self‑contained payloads, for a variety of targets.
Here you can see a few examples for Windows, Python,
which is a programming language and development
environment, and the Android platform.
There are stages as well.
Here are a few examples for Windows, Linux on x86,
and a 64‑bit version for Windows.
There are many others as well.
Meterpreter is flexible and impressive in its capabilities.
First, when discussing Meterpreter, there's always a client and server.
The client side resides on the attacking system.
The server side is always on the target.
This is always true,
regardless of whether the network connection to the target was
established through a forward or reverse connection.
Like Metasploit,
Meterpreter is also modular, loaded either as a staged or single
payload. And new functionality can be added to an existing Meterpreter
session by passing additional code to the server.
Meterpreter operates completely in memory on the target system
using a technique called reflective DLL injection,
which means that the base code and any additional functionality is
loaded into the memory of a compromised running process.
It also means that there's nothing written to disk.
Meterpreter is a very flexible payload.
There are specific DLLs that provide the core functionality
for system exploration and manipulation,
and more can be loaded as needed.
Once you have a Meterpreter session on a compromised target system,
the command prompt will change to indicate the Meterpreter session.
Here are some commands for exploring the target system's files.
Meterpreter has in‑session documentation,
so you can always review how to use the commands available.
There are fairly standard commands for exploring the file system on the target.
They should be familiar to Linux users.
There are also commands to look at and change the contents of files.
Meterpreter also has commands to examine and change the system itself.
Some commands are operating system specific.
There are commands to gather system details,
look at and change the Windows registry, and examine the current process
and account details to which Meterpreter is attached.
There are commands to run, examine, and terminate processes.
It is also possible to restart and shut down the system.
Meterpreter can also load a variety of extensions to
extend its functionality even further.
The load command will load the additional functionality, and any
documentation can be reviewed with the help command.
My interpreter can also run Metasploit play post modules as well.