Meterpreter & Session Management

In the exploitation phase you fired a payload at a vulnerable service and caught a connection back. That connection is a Meterpreter session — the advanced, dynamically extensible payload that ships with Metasploit. It is not a program sitting on the target's disk. It is code injected into the memory of a running process, speaking a custom protocol back to your console. Everything you are about to do happens from that session.

Two facts about Meterpreter shape every decision in this phase. First, it lives in memory: there is no executable dropped to disk for antivirus to scan or for an investigator to find later, which makes it quieter than a traditional implant. Second, because it is borrowing a host process to exist, it dies when that process dies. If the exploited service crashes, gets patched, or simply gets closed by the user who owns it, your session evaporates — and with it, your access. That single fragility is the reason stability is a theme you will hear repeated throughout this lesson.

A real engagement is rarely one shell. You may land footholds on several hosts, and you need to move between them without losing any. Meterpreter and msfconsole are built for exactly this — sessions are objects you can park, list, and resume at will.

• Background a session. From inside a Meterpreter prompt, type background (or press Ctrl+Z) to drop back to the main msf console while leaving the session alive and running in the background. You have not closed it — you have set it down.
• List what you hold. Back at the msf prompt, sessions -l prints every active session with an ID, the type, the user it is running as, and the remote host. This is your inventory of footholds.
• Interact with one. sessions -i 1 drops you back into session number 1 exactly where you left it. Background it again, jump to sessions -i 2, and you are operating on a second host.

The mental model is a switchboard. Each session is a separate, persistent line to a separate machine; backgrounding and interacting are how you switch between them. An operator on a live engagement often juggles several sessions at once — running enumeration on one host while staging the next move on another — and the sessions command is the control panel for all of it.

Once you are interacting with a session, you have a built-in toolkit that works the same way regardless of how you got in. These are the commands you will reach for first on almost every host. Learn what each one tells you or does — the goal of early post-exploitation is to answer "where am I, who am I, and how do I stay here?"

Of all of these, migrate earns special attention. When your payload first lands, it lives inside whatever process the exploit happened to compromise — frequently something fragile, short-lived, or owned by a user who could close it at any second. If that process exits, your session dies with it. Migrating moves your foothold into a sturdier, more permanent host — a long-running system service, for example — so a crash in the original exploited process no longer costs you access. Done well, it also blends in: a session running inside an ordinary, expected process draws far less attention than one parked in something that has no business being there. Stabilize first, then operate.

The built-in commands cover the essentials, but they are only the surface. Metasploit ships hundreds of post/ modules — purpose-built scripts that automate the deeper work of post-exploitation against a session you already hold. Where getuid answers one question, a post module can sweep an entire host for you.

The pattern is consistent. From inside a session, run a module against it with run post/<module>. The modules are organized by platform and purpose, so the path tells you what you are getting:

• Enumeration — post/windows/gather/enum_logged_on_users, post/windows/gather/enum_shares, and similar modules harvest the host's installed software, network configuration, shares, and logged-on users in one pass.
• Credential harvesting — modules under post/windows/gather/credentials/... pull saved passwords, tokens, and secrets out of browsers, applications, and the operating system.
• Host and network discovery — gather modules map what the compromised host can see, surfacing other systems and routes you could not reach from outside.

One module deserves a special mention before the next lesson: the local exploit suggester. Run run post/multi/recon/local_exploit_suggester against a session and Metasploit checks the host's OS and patch level against its catalog of local privilege-escalation exploits, then hands you a shortlist of the ones likely to work. It will not do the escalation for you, but it turns "I need to get higher privileges somehow" into a concrete, ranked set of options — the natural bridge into the privilege-escalation material that follows.

A compromised host is rarely the destination — it is a doorway. The machine you landed on can usually see other systems that were never reachable from where you started: an internal subnet, a database server, a domain controller sitting behind the perimeter. Meterpreter can turn your single foothold into a route into that hidden network, tunneling your traffic through the compromised host so the tools on your machine can reach the systems beyond it.

• route — adds the compromised host's internal networks to Metasploit's routing table, so other Metasploit modules can reach hosts that only the foothold can see.
• portfwd — forwards a specific port through the session, letting a tool on your machine connect to a service deep inside the target network as if it were local.

That capability — pivoting — is how a single compromised workstation becomes a path to the crown jewels, and it gets a full treatment in the lateral-movement lesson. For now, know that the session you stabilized here is the launch point for it.

Close every session on the same discipline that makes all of this defensible:

• Confirm what you have. sysinfo and getuid first — know the host and the privilege level before you act.
• Migrate for stability. Get out of the fragile exploited process and into a durable one before you do anything you cannot afford to lose.
• Take notes continuously. Session IDs, hosts, credentials found, actions taken — the record is what becomes the report.
• Stay inside the scope. Every command on this page assumes a signed, authorized engagement. The same techniques without written permission are simply intrusion; the authorization is what makes you a tester instead of an attacker.

With a stable session in hand and a clear picture of the host, the next step is to climb: turning the foothold you have into full control of the machine. That is Windows privilege escalation.