I85PREP
⌘ K
MSF RCP study materials
MSF RCP study resources

MSF RCP: Meterpreter and Post-Exploitation

MSF RCP · Work through your exam, one topic at a time.

All guide sections

Meterpreter and Post-Exploitation

Meterpreter and post-exploitation tests whether you can operate a session, escalate privileges carefully, collect evidence, pivot into reachable networks, and clean up. Expect questions on getsystem, migrate, hashdump, post modules, routing, port forwarding, and session management.

Core rules

  • Basic session commands include sysinfo, getuid, ps, migrate, getsystem, hashdump, shell, upload, download, and background.
  • getsystem attempts several named privilege-escalation techniques; it can fail or destabilize a session. migrate moves Meterpreter into another process for stability, but migrating into a short-lived or protected process can kill the session.
  • Post modules run with run post/... or use post/.... Examples include post/multi/recon/local_exploit_suggester, post/windows/gather/hashdump, and post/windows/manage/enable_rdp.
  • Pivoting uses the compromised host as a router. route add 10.10.20.0/24 <session> sends traffic for that subnet through the session; portfwd add -L 127.0.0.1 -l 3389 -r 10.10.20.5 -p 3389 forwards a local port.
  • auxiliary/server/socks_proxy plus a SOCKS-capable client can proxy tools through the session. Pivoting does not expand your authorization; it only expands reachability.

Worked example

You have a low-privilege Meterpreter session on 10.10.10.23. Run getuid; if not SYSTEM, run run post/multi/recon/local_exploit_suggester, then try getsystem. If stable, run hashdump and store the output. Add route add 10.10.20.0/24 1, then use auxiliary/scanner/portscan/tcp with RHOSTS 10.10.20.0/24. Reasoning: escalate only after checking the host, collect credentials only when in scope, and route through the session to test the internal segment. Document each action.

Traps

  • Running hashdump without SYSTEM privileges and reporting failure as a host limitation.
  • Migrating into a process that exits, losing the session.
  • Pivoting into a subnet that the rules of engagement exclude.
  • Leaving persistence or new accounts behind without written approval.
  • Confusing route with portfwd; one routes subnets, the other forwards a single port.