# Metasploit/MeterpreterClient

Meterpreter > shell

# Introduction

TODO - meterpreter introduction.

# Commands
## Core Commands

We can use ? or help to show a list of commands with brief descriptions.

### background

Using the background command places the current session into the background and brings us back to the Metasploit console without terminating the session. We can begin to interact with the session again by using the sessions Metasploit command.

### channel

TODO Displays information about active channels

### close

TODO Closes a channel

### exit

Returns to the Meterpreter console and closes the active session.

### help

We can use ? or help to show a list of commands with brief descriptions.

### interact

TODO Interacts with a channel

### irb

We can start the Interactive Ruby Shell with the irb command, allowing us to use the Ruby scripting language to interact with the compromised system.
To view the API, we need to run the rdoc command from the Metasploit directory, which will create a doc/index.html file that we can open with a browser. View the Rex::Post::Meterpreter section of the API for the relevant section.

### migrate

Meterpreter initially runs inside the exploited process or as its own executable's process in some cases. If that process is stopped for any reason, the Meterpreter session will close, so it is good practice to migrate the session to more stable process such as Windows' explorer.exe.
The following example shows the use of a handful of commands in order to locate a process that the user will not close during his or her session. The commands are:
* ps - Show a list of running processes.
* getpid - Display the process Meterpreter is using, which shows an EXE payload meter-443.exe.
* migrate pid - Move Meterpreter to a new process ID number, where we request the McAfee agent.
* getpid - Display the new process Meterpreter is using, which we verify is the McAfee agent process.

### quit

Returns to the Meterpreter console and closes the active session.

### read

TODO Reads data from a channel

### run

We can execute a Meterpreter script using the run command. If no path is specified, Meterpreter will search for the script in the scripts/meterpreter/ directory.
In the following example we are running the scripts/meterpreter/scraper.rb script, which pulls some basic information from the target. The information is logged to the ~/.msf3/logs/scraper directory.

### use

For additional commands and functionality we can load Meterpreter extensions with the use command.
In the following example, we would like to use the hashdump command to retrieve password hashes from the target. By using the use priv command we can load the extension that gives us the hashdump command. We can verify this by using ? to list our available commands.

### write

TODO Writes data to a channel

## File System Commands
### cat

The cat command displays the contents of a single file. As of the time of this writing, the command will throw an error when trying to read an emtpy file.

### cd

To change directory the cd command is used.
The command will accept both back and forward slashes somewhat interchangeably, though using a forward slash seems to work more frequently. "." and ".." are used to access the current and parent directory, respectively, and double-quotes can be used to access directories with spaces in the names.

### download

When we need to retrieve a file from the target we use the download command, which transfers the specified file into our local working directory. In the event that we need to recursively download an entire directory, we use the download -r command.

### edit

To edit a file using our default text editor we use the edit command. Behind the scenes, Meterpreter will download a copy of the file to a temp directory, then upload the new file when the edit is complete.

### getlwd

We can show the current working directory on our local machine by using getlwd (get local working directory), or by using the alias lpwd (local print working directory).

### getwd

We can show the current working directory on the exploited machine by using getwd (get working directory), or by using the alias pwd (print working directory).

### lcd

To change the local directory we use the lcd command.
The command only accepts arguments in the same way as your operating system's cd command, so refer to your system's documentation for specific instructions. The following example shows lcd on a Linux system.

### lpwd

We can show the current working directory on our local machine by using lpwd (local print working directory), or by using the alias getlwd (get local working directory).

### ls

We can see both the current working directory and a detailed listing of files in that directory by using the ls command. File listings are given in a format similar to the GNU ls program.

### mkdir

We use mkdir to make a new directory on the target system.

### pwd

We can show the current working directory on our local machine by using pwd ( print working directory), or by using the alias getwd (get working directory).

### rmdir

We can remove an empty directory with the rmdir command. The command will throw an error if the directory is not empty.

### upload

To send a file to the target system we use the upload command, using the -r switch to recursively upload directories and their contents. In the following example we are uploading a falsely named Meterpreter payload.

## Networking Commands
### ipconfig

By using the ipconfig command, or internet protocol configuration, we can view a listing of all network interfaces on the target. Viewing the results for ipconfig is most useful for determining to which networks the target is directly connected.
For example, looking at the following we can see that the target is connected to the 192.168.50.0/24 network, with an internal address of 192.168.50.100.

### portfwd

Forward a local port to a remote service

### route

View and modify the routing table

## System Commands
### execute

Execute a command
To execute a command you need to use execute "-f" for file "cmd.exe" application
This will be executed in the background. To check this type ps
execute -f cmd.exe 54124---> process id

### getpid

Get the current process identifier

### getuid

Get the user that the server is running as

### kill

Terminate a process

### ps

The ps command lists the running processes, and is an important command for a couple reasons. First, it is a good idea for us to be aware of applications and services running on the target in order to have awareness of the system. Secondly, Meterpreter initially runs inside the exploited process or as its own executable's process in some cases. If that process is stopped for any reason, the Meterpreter session will close, so it is good practice to migrate the session to more stable process such as Windows' explorer.exe.

### reboot

By running the reboot command, we will restart the target system.

### reg

Modify and interact with the remote registry

### rev2self

Calls RevertToSelf on the remote machine

### shutdown

Using the shutdown command will shut off the target system.

### sysinfo

During the post-exploitation phase, one of the earliest commands that we should run is the sysinfo command. Running this command will give us the Computer Name and OS version, which often offers a clue to the purpose of the target system.

## User Interface Commands
### enumdesktops

TODO List all accessible desktops and window stations

### idletime

Using the idletime command will return the length of time that the target system's user has been idle.

### keyscan_dump

We can capture the keyboard input of the target using the keyscan series of commands. The keyscan_start and keyscan_stop commands will begin and end recording keystrokes respectively, while the keyscan_dump command displays all recorded keystrokes on our client.

### keyscan_start

We can capture the keyboard input of the target using the keyscan series of commands. The keyscan_start and keyscan_stop commands will begin and end recording keystrokes respectively, while the keyscan_dump command displays all recorded keystrokes on our client.

### keyscan_stop

We can capture the keyboard input of the target using the keyscan series of commands. The keyscan_start and keyscan_stop commands will begin and end recording keystrokes respectively, while the keyscan_dump command displays all recorded keystrokes on our client.

### setdesktop

TODO Move to a different workstation and desktop

### uictl

Using the uictl command we have the ability to disable keyboard and mouse input on the target.