> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/exploit/metasploit-framework/meterpreter.md).

# Meterpreter

## Basic navigation

<table><thead><tr><th width="194">Command or Key(s)</th><th>Description</th></tr></thead><tbody><tr><td>&#x3C;Tab></td><td>Auto-completion for commands (but not for files)</td></tr><tr><td>&#x3C;Tab>&#x3C;Tab></td><td>Show list of possible matches</td></tr><tr><td>&#x3C;Up> | &#x3C;Down></td><td>Scroll through history</td></tr></tbody></table>

## Metasploit commands

### Help commands&#x20;

<table><thead><tr><th width="230">Command</th><th>Description</th></tr></thead><tbody><tr><td>?</td><td>Show help menu</td></tr><tr><td>help</td><td>Show help menu</td></tr><tr><td>help &#x3C;cmd></td><td>Show help on command &#x3C;cmd></td></tr><tr><td>&#x3C;cmd> -h</td><td>Show help on command &#x3C;cmd></td></tr><tr><td>info &#x3C;module></td><td>Prints information about a post-exploitation module</td></tr></tbody></table>

### Common commands

<table><thead><tr><th width="209">Command</th><th>Description</th></tr></thead><tbody><tr><td>background</td><td>Backgrounds the current session</td></tr><tr><td>bg</td><td>Alias for background</td></tr><tr><td>download &#x3C;file | dir></td><td>Download file or directory from compromised machine</td></tr><tr><td>exit</td><td>Terminate the meterpreter session</td></tr><tr><td>getpid</td><td>Show current process ID that Meterpreter is running inside</td></tr><tr><td><a href="https://docs.rapid7.com/metasploit/meterpreter-getsystem/">getsystem</a></td><td>Attempt to elevate your privilege to that of local system.</td></tr><tr><td>getuid</td><td>Show current user ID that Meterpreter is running with</td></tr><tr><td>hashdump</td><td>Dumps the contents of the SAM database</td></tr><tr><td>load &#x3C;extension></td><td>Load meterpreter extension. <br>Common extensions are: priv, incognito, or sniffer</td></tr><tr><td>migrate &#x3C;pid></td><td>Migrate to process with PID &#x3C;pid></td></tr><tr><td>run &#x3C;script></td><td>Executes a meterpreter script or Post module</td></tr><tr><td>shell</td><td>“Downgrade” Meterpreter shell into a system command shell</td></tr><tr><td>sysinfo</td><td>Gets information about the remote system, such as OS</td></tr><tr><td>upload &#x3C;file | dir></td><td>Upload file or directory to compromised machine</td></tr></tbody></table>

### File system commands

<table><thead><tr><th width="213">Command</th><th>Description</th></tr></thead><tbody><tr><td>cat &#x3C;file></td><td>Read the contents of a file to the screen</td></tr><tr><td>cd &#x3C;dir></td><td>Change directory on compromised machine</td></tr><tr><td>dir</td><td>List files (alias for ls)</td></tr><tr><td>download &#x3C;file | dir></td><td>Download file or directory from compromised machine</td></tr><tr><td>lcat &#x3C;file></td><td>Read the contents of a local file to the screen</td></tr><tr><td>lcd &#x3C;dir></td><td>Change local working directory</td></tr><tr><td>lls</td><td>List local files</td></tr><tr><td>lpwd</td><td>Print local working directory</td></tr><tr><td>ls</td><td>List files</td></tr><tr><td>mkdir &#x3C;new_dir></td><td>Make directory</td></tr><tr><td>pwd</td><td>Print working directory on compromised machine</td></tr><tr><td>search -f "string"</td><td>Search for files named &#x3C;string>. <br>Wildcards allow such as *password*</td></tr><tr><td>upload &#x3C;file | dir></td><td>Upload file or directory to compromised machine</td></tr></tbody></table>

### Networking commands&#x20;

<table><thead><tr><th width="230">Command</th><th>Description</th></tr></thead><tbody><tr><td>arp</td><td>Display the host ARP cache</td></tr><tr><td>getproxy</td><td>Display the current proxy configuration</td></tr><tr><td>ifconfig</td><td>Display interfaces</td></tr><tr><td>ipconfig</td><td>Display interfaces</td></tr><tr><td>netstat</td><td>Display the network connections</td></tr><tr><td>portfwd</td><td>Forward a local port to a remote service</td></tr><tr><td>resolve</td><td>Resolve a set of host names on the target</td></tr><tr><td>route</td><td>View and modify the routing table</td></tr></tbody></table>