Post cover image

July 28, 2026

Metasploit: Meterpreter TryHackMe Room Walkthrough (Part 3)

room link:https://tryhackme.com/room/meterpreter

By Amr Sebie

3 min read

Introduction

After gaining initial access to a target, penetration testers need to enumerate the compromised system, identify privileges, search for sensitive information, and assess opportunities for further compromise.

Meterpreter is a Metasploit payload designed to support this post-exploitation phase through a specialized interactive session.

In this room, we will learn how Meterpreter works, understand its different payload types, and use common commands for system enumeration, process management, credential discovery, and file searching.

Task 1 — Introduction to Meterpreter

Summary

Meterpreter is a post-exploitation payload that provides an interactive session on a compromised system.

One of its notable characteristics is its ability to operate primarily in memory rather than relying on an obvious executable file on disk. It can also communicate with the Metasploit handler through encrypted channels.

This can make basic detection more difficult, but Meterpreter is not undetectable. Modern security solutions can detect suspicious behavior through endpoint telemetry, memory analysis, and network monitoring.

Process Identification

The getpid command shows the PID of the process hosting the current Meterpreter session:

meterpreter > getpid
Current pid: 1304

We can then inspect running processes:

meterpreter > ps

In the lab, PID 1304 belonged to:

spoolsv.exe

rather than a process named meterpreter.exe.

The key lesson is that simply searching for an obvious Meterpreter process name may not be enough to identify malicious activity.

Answer: No answer needed

Task 2 — Meterpreter Flavors

Summary

Meterpreter comes in different versions depending on the target platform and communication method.

The two main payload categories are:

Staged payloads

The initial stager connects back and retrieves the rest of the payload.

Stager → Full Payload

Stageless payloads

The complete payload is delivered in one package.

Full Payload

You can list available Meterpreter payloads with:

msfvenom --list payloads | grep meterpreter

Meterpreter supports platforms including:

  • Windows
  • Linux
  • Android
  • macOS
  • iOS
  • Java
  • PHP
  • Python

Payload selection mainly depends on:

  • Target OS and architecture
  • Available technologies
  • Network connectivity
  • Exploit compatibility

For example, an exploit may automatically select a default payload:

msf6 > use exploit/windows/smb/ms17_010_eternalblue
[*] Using configured payload windows/x64/meterpreter/reverse_tcp

You can check compatible payloads with:

show payloads

The important point is that not every Meterpreter payload is compatible with every exploit.

Answer: No answer needed

Task 3 — Meterpreter Commands

Summary

Meterpreter provides commands for common post-exploitation activities.

Because available commands differ between Meterpreter versions and loaded extensions, the first command you should usually run is:

help

Common command categories include:

  • Core
  • File system
  • Networking
  • System
  • Privilege-related functionality

Common Commands

Core Commands

help
background
sessions
exit
load
migrate

File System

pwd
ls
cd
cat
search
upload
download

System Enumeration

getuid
getpid
ps
sysinfo
shell

Networking

ifconfig
arp
netstat
route

Important Commands

getuid

Shows the account running the Meterpreter session:

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

This is important because it tells you your current privilege level.

ps

Lists running processes:

meterpreter > ps

The output provides PIDs and process information, which can be useful when analyzing the system or considering process migration.

migrate

Moves the Meterpreter session to another process:

meterpreter > migrate 716

Migration can sometimes improve session stability or place the session inside a more suitable process.

However, migrating into a process owned by a lower-privileged user can cause you to lose your current privileges.

Always check the target process and its user context before migrating.

hashdump

Attempts to retrieve Windows password hashes from the SAM database:

meterpreter > hashdump

These hashes may be useful for offline password cracking or, in supported environments, pass-the-hash attacks.

Searches the filesystem for files:

meterpreter > search -f flag2.txt

This is useful for locating:

  • Configuration files
  • Credentials
  • Backups
  • Flags
  • Sensitive documents

shell

Opens the native operating system shell:

meterpreter > shell

On Windows, this gives you a normal command prompt:

C:\Windows\system32>

You can return to the Meterpreter session by suspending the shell with:

CTRL + Z

Answer: No answer needed

Practical Task — Meterpreter Post-Exploitation

Step 1 — Establish Initial Access

The lab provides credentials to simulate an initial compromise over SMB:

Username: ballen
Password: Password1

After obtaining a Meterpreter session, the goal is to move beyond initial access and start enumerating the compromised machine.

The general workflow is:

Initial Access
      ↓
System Enumeration
      ↓
Privilege Enumeration
      ↓
Credential Discovery
      ↓
Sensitive File Discovery
      ↓
Further Access

Step 2 — Identify the Host

The compromised computer name is:

ACME-TEST

Knowing the hostname helps identify the system during further enumeration and can be correlated with other hosts in the environment.

Step 3 — Identify the Domain

The target domain is:

FLASH

This indicates that the machine belongs to a Windows domain environment, which may provide opportunities for further enumeration and lateral movement.

Step 4 — Enumerate User-Created Shares

The user-created share discovered during enumeration is:

speedster

Shares are worth investigating because they may contain documents, scripts, backups, or credentials.

Step 5 — Extract Credential Material

The NTLM hash belonging to jchambers was:

69596c7aa1e8daee17f8e78870e25a5c

The corresponding cleartext password was:

Trustno1

From a penetration testing perspective, the important question is whether this credential is reused elsewhere.

Credential reuse can turn access to one machine into access to additional systems.

Step 6 — Search for Sensitive Files

The secrets.txt file was discovered at:

c:\Program Files (x86)\Windows Multimedia Platform\secrets.txt

The file contained a Twitter password:

KDSvbsw3849!

This demonstrates the risks of storing credentials in plaintext files.

Step 7 — Locate the Final Secret

The file:

realsecret.txt

was located at:

c:\inetpub\wwwroot\realsecret.txt

Its contents were:

The Flash is the fastest man alive

The location is interesting because C:\inetpub\wwwroot is commonly associated with IIS web content.

If sensitive files are placed inside a web root and the server is incorrectly configured, they may potentially become accessible through the web application.

If this summary helped you save some time (or a few brain cells ), don't forget to follow and leave a 👏 Clap. It really helps and motivates me to keep making more cybersecurity notes like this ❤️