Metasploit Meterpreter 2026: All Commands, Post-Exploitation & Detection

Red Team & OSCP

The de-facto post-exploitation agent for lab exams and engagements — session handling, privesc and pivoting in one interface instead of a dozen scripts.

Detection Validation

Generate real in-memory C2 traffic in a lab to confirm your EDR flags migration, reflective injection and beaconing before an adversary tests it for you.

Purple Teaming

Run a known Meterpreter technique, watch which Sysmon and Defender events fire, and tune analytics against ground truth you control.

Analyst Training

Show SOC staff what post-exploitation looks like on the wire and on the host so they recognise the real thing in an incident.

On Kali it is already there. On any other Debian/Ubuntu host use the official nightly installer script. For a disposable, reproducible setup use the maintained Docker image. Pick one.

Metasploit uses PostgreSQL to store hosts, services, loot and sessions across runs. Initialise it once; it makes workspaces, hosts and creds work inside msfconsole.

Search for the module, select it, and read what it needs. show options lists required settings; info shows targets, references and the CVE it maps to.

An exploit module has a default payload, but you choose it explicitly. Match the architecture (x64) and transport to the target. HTTPS transport is more reliable through proxies and encrypts the channel.

Fire the exploit. On success the stager connects back, the stage loads in memory, and you drop into the meterpreter > prompt. Run -j to keep the handler as a background job instead of taking the foreground.

Payload names follow OS/ARCH/payload/transport. Browse the Meterpreter options so you pick the exact match for your target platform.

Same tool, different -p and -f. Windows EXE, Linux ELF, Android APK and a PHP web payload — the four you will reach for most. Always set LHOST/LPORT to your handler.

Encoding reshapes the bytes (historically for AV, realistically for bad-character constraints in exploit buffers). Strip bytes that break your delivery with -b, and template into a real binary with -x.

The handler must use the exact same payload, LHOST and LPORT as the generated file. Start it as a background job before you deliver, and the session lands the moment the payload runs on the target.

Choose a target language with set TARGET (2 = PowerShell), set the Meterpreter payload, and run. Metasploit prints the one-liner to paste wherever you have code execution.

In the lab, run the printed one-liner in a PowerShell window on your target VM to simulate the code-execution step. In an engagement it rides whatever foothold you already have — a web shell, a macro, a scheduled task.

Already have a dumb command shell from another tool? Promote it to a full Meterpreter session in one command — Metasploit generates and injects the right payload for you.

First four commands on every session: who am I, what box is this, what is my process, and what else is running. This is your situational awareness before you touch anything.

If the exploited process dies, your session dies with it. Migrate into a long-lived, same-architecture process (e.g. explorer.exe or winlogon.exe). Match the bitness or migration fails.

Background the current session to return to msfconsole, list all sessions, re-enter one, or kill the ones you are done with. background is how you keep a session alive while you run another module against the same host.

Drop into a native OS shell, or spawn a hidden process directly. execute -H -i runs a program hidden and channels its I/O back to you.

Meterpreter gives you Unix-style filesystem verbs on any OS. Note the l-prefixed commands (lpwd, lcd) act on your local attacker box — handy when staging uploads and downloads.

Recursively find files by pattern across the disk — password vaults, config files, SSH keys, spreadsheets. This is often where the real loot is.

The compromised host is your window into the internal network. Read its interfaces, routing table, ARP cache and active connections — this is the reconnaissance that feeds pivoting in Phase 09.

The stdapi extension exposes surveillance primitives. In an authorised test these demonstrate real impact; document scope carefully, because capturing a live user's screen or keystrokes is intrusive.

Load the priv extension and try the built-in SYSTEM escalations (named-pipe impersonation and token duplication). Check your privileges first — if you already hold SeImpersonatePrivilege, dedicated potato-style modules are more reliable.

When getsystem fails, let Metasploit profile the host and list kernel/service exploits that match its patch level. Background the session first, then point the post module at it.

With SYSTEM you can load kiwi — the in-memory Mimikatz extension — and pull hashes, cleartext secrets and Kerberos tickets straight from LSASS memory. These feed pass-the-hash and Kerberos attacks on the rest of the domain.

On a box where a privileged user is logged in, you can impersonate their access token without ever cracking a password. Load incognito, list available tokens, and assume one.

Hundreds of post modules automate gather and manage tasks. Run them from the Meterpreter prompt with run post/... or background and use them for more options.

Use a post module to install a callback that survives reboot — a service, a scheduled task, or a registry Run key. Always record exactly what you create so you can remove it cleanly.

Teach Metasploit to route traffic for a new subnet through your session. After this, other Metasploit modules can reach hosts on 10.10.20.0/24 that are only visible from the compromised machine.

Forward a single remote port to your localhost, or stand up a SOCKS proxy so external tools (nmap, a browser, Impacket) can reach the internal network through the pivot via proxychains.

The NT hash you dumped with kiwi is a credential in its own right. Feed it to the psexec module to authenticate to another host over SMB and pop a fresh Meterpreter — no password cracking required.

Beyond the auto-loaded stdapi and priv, you pull in capability as needed. python and powershell let you run full scripts in-memory without dropping files.

Automate repetitive setup with a resource script, or run actions automatically the instant a session opens. Great for consistent handlers and for immediately migrating out of a fragile process.

For full programmatic control — orchestration, custom tooling, CI-driven detection tests — run the RPC daemon and drive Metasploit from Python with the pymetasploit3 library.

Migration creates a remote thread in another process. Hunt for cross-process thread injection, especially where the target is a sensitive process like lsass.exe or a browser.

The load kiwi / creds_all workflow reads LSASS memory. Alert on any process opening lsass.exe with high-access rights that is not a known defender or backup agent.

Meterpreter C2 beacons at a regular interval. Hunt for a single process making many near-identical outbound connections to one destination with low-variance timing — the shape of a beacon, regardless of port.

Mapping the techniques above to ATT&CK gives your detections coverage language and tells you which gaps remain.

The same configuration work that stops Meterpreter stops most commodity post-exploitation. Prioritise the controls that break its core techniques rather than chasing payload signatures.

Nearly every "Meterpreter won't work" problem is a handler, network or architecture mismatch — not a bug. This table covers the failures that account for most lost sessions.