Meterpreter Commands Cheat Sheet 2026 — 50+ Commands With Real Examples

This article is a detailed command reference and workflow guide for Meterpreter post-exploitation, covering the complete sequence from initial shell acquisition through system reconnaissance, privilege escalation, credential harvesting, network pivoting, and persistence installation. It addresses the gap between obtaining a Meterpreter session and conducting effective post-exploitation work that produces actionable penetration testing findings, providing real command examples and structured exercises for authorised lab environments.

• Five-command baseline for every sessionThe article identifies sysinfo, getuid, getpid, ps, and ifconfig as the first commands to run on every new Meterpreter session because they establish critical baseline information: OS version and architecture (determines applicable exploits), current user context (admin status), running processes (identifies SYSTEM targets for migration), and network interfaces (reveals internal subnets for pivoting). These five commands take under 60 seconds and determine every subsequent exploitation decision.
• Three privilege escalation approaches in orderThe article explains Meterpreter's privilege escalation hierarchy: attempt getsystem first (automated multi-technique approach that surprisingly works on misconfigured systems), then migrate into an existing SYSTEM process identified from ps output (faster and stealthier than exploits), and finally run local_exploit_suggester to identify specific CVE-based exploits if both fail. The article emphasizes that migration into an accessible SYSTEM process is the most direct path when available.
• In-memory file operations and search capabilitiesMeterpreter's file operations (upload, download, search) run entirely in memory through the encrypted channel without obvious filesystem artifacts. The search command can locate sensitive files efficiently across the entire filesystem using wildcards and directory scoping, such as searching for configuration files, SSH keys, or KeePass databases across specified paths.
• Credential harvesting with hashdump and KiwiThe article covers two credential harvesting approaches requiring SYSTEM privileges: hashdump extracts NTLM hashes directly from the Windows SAM database, while loading Kiwi (Meterpreter's integrated Mimikatz) provides cleartext passwords where available from LSASS memory via creds_all, creds_wdigest, creds_msv, and kerberos_ticket_list commands. These hashes feed directly into offline cracking tools like Hashcat.
• Route and SOCKS proxy for internal network pivotingThe article explains that pivoting requires two components: route add [subnet] [session] establishes a routing entry through the compromised host to an internal network, then auxiliary/server/socks_proxy creates a SOCKS server on the attacker's Kali machine. Configuring proxychains to use 127.0.0.1:1080 makes all tools transparently reachable to the internal network through the pivot, enabling scanning and exploitation of networks the attacker cannot reach directly.
• Persistence installation and mandatory cleanupThe article presents persistence mechanisms including run persistence with autostart flags (-X for boot startup, -i for retry intervals), registry run keys, and scheduled task methods. Critically, it emphasizes that every persistence mechanism must be documented and removed before engagement completion—the Metasploit persistence modules automatically generate a cleanup script at /root/.msf4/logs/persistence/ that must be executed, as leaving persistence behind is identified as one of the most serious penetration testing mistakes.
• Network reconnaissance reveals pivoting opportunitiesThe article highlights that ifconfig output is particularly important because any network interface beyond the directly connected interface reveals an internal network the target can access—this represents the actual pivoting target. The article emphasizes that discovering a second internal interface transforms a single-host finding into network-wide compromise potential, often demonstrating that assumed network segmentation was not enforced in practice.

Bottom line: Meterpreter post-exploitation follows a structured workflow starting with the first-five baseline commands, escalating privileges via getsystem or process migration, harvesting credentials with hashdump and Kiwi, and pivoting to internal networks via route and SOCKS proxy—and this entire engagement must conclude with documented removal of all installed persistence mechanisms before completion.