08. Post-exploitation — What you can do with meterpreter 🔓¶
meterpreter >appeared = the intrusion succeeded. From here on is "post-exploitation." We investigate the inside of the target we've broken into.
What is meterpreter¶
A high-functionality remote-control agent dedicated to Metasploit. It's more convenient than a plain shell: file operations, privilege checks, and information gathering can each be done with a single command.
Investigating what you've broken into¶
First, "who did I get in as?"
root = the highest privilege. In S2-045, the target (Struts2) was running as root, so the moment you exploit the vulnerability, you get root. This is what CVSS 10.0 means.
Next, investigate the identity and current location of the machine you've entered.
meterpreter > sysinfo # OS and architecture
meterpreter > pwd # Where am I right now
meterpreter > ls # What's here
meterpreter > shell # Drop into a regular Linux shell (exit to leave)
A list of commonly used commands is collected in Appendix A. Reference. As a rule, you type commands interactively at the
meterpreter >prompt.
The big picture of what you can do post-exploitation¶
Grasping the situation is just the entry point. After the intrusion, things unfold like this.
flowchart LR
A["① Situational awareness<br>getuid/sysinfo"] --> B["② Privilege escalation<br>regular → root"] --> C["③ Persistence<br>a mechanism to re-enter"] --> D["④ Internal recon<br>survey the internal network"] --> E["⑤ Lateral movement<br>to a neighboring machine"]
style A fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3
style B fill:#2d333b,stroke:#bc8cff,stroke-width:2px,color:#e6edf3
style C fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3
style D fill:#2d333b,stroke:#d29922,stroke-width:2px,color:#e6edf3
style E fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3| Stage | What you do |
|---|---|
| ① Situational awareness | Who you got in as, and which OS you entered (getuid sysinfo) |
| ② Privilege escalation | If you're a regular user, aim for root (this time you're root from the start) |
| ③ Persistence | A mechanism to get back in even after a reboot (run persistence, etc.) |
| ④ Internal recon | Survey the network again, from the inside |
| ⑤ Lateral movement | Use the compromised host as a pivot to another machine (→ next chapter) |
💡 Internal recon is important: the nmap you ran before the intrusion only sees "ports visible from outside." When you investigate from the inside after breaking in, you can see internal services and neighboring machines that were invisible from outside. This is what makes an intrusion so dangerous.
③ Why persistence is dangerous — the backdoor survives even after the vulnerability is fixed¶
Persistence means "while you're still inside, plant a back door so you can get in again next time." This is the most important insight here.
flowchart LR
V["① Break in via<br>a vulnerability"] --> B["② While inside,<br>plant a back door"]
B --> F["③ The vulnerability<br>gets patched"]
F --> R["④ But the back door remains<br>→ still able to get in"]
style V fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3
style B fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3
style F fill:#2d333b,stroke:#3fb950,stroke-width:2px,color:#e6edf3
style R fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3The original entry point (the vulnerability) ──→ patched → no longer usable
↓ but while inside,
plant a back door ───→ still alive after the patch → still able to get in
🔑 This is the core: the attacker creates a back door separate from the original hole (the vulnerability). So even after the vulnerability is patched, the planted back door remains, and the attacker can keep getting in. "We fixed the vulnerability, so we're safe" is not necessarily true — this is the real danger of persistence.
Examples of planting a back door: have cron connect back to you periodically / quietly add an SSH key / drop a reconnect script in the web app's startup directory, and so on.
You can also plant one with meterpreter's run persistence (though the target needs cron/systemd, etc.).
🛡️ This is why defenders (the blue team) must not only fix vulnerabilities but also check whether a back door has already been planted. How to check → 10. Blue-team tools.
Congratulations 🎉¶
You've now experienced the full sequence — recon → attack → intrusion → post-exploitation — with your own hands. This flow is a fundamental that's asked about as-is in both real-world pentest work and certification exams (eJPT, PT1, etc.).