Meterpreter File System Commands Cheatsheet

Hey Friends!

Did you know that meterpreter is known as Hacker’s Swiss Army Knife!!

Well! Know you do.

Meterpreter, a highly developed payload that can be extended dynamically, is known to be Hacker’s Swiss Army Knife. It uses reflective DLL injection technique to further compromise the target after attack. Meterpreter is known to influence the functionality of Metasploit framework. It can help in doing a lot many things. Some of these include covering tracks after the attack, accessing operating system, and dumping hashes.

This article discusses meterpreter’s Stdapi File System Commands. There are 21 commands including cat, cd, pwd, and checksum. Figure 1 summarises them:

Let’s start discussing them.

cat: It is the very first command in the group of Stdapi File System Commands. It reads the contents of a file to the screen. In other words, cat displays a file’s contents. cat command in meterpreter is same as cat command used in Unix/Linux systems. 

The syntax of cat in meterpreter is as follows:

cat filename

cd and pwd: Though cd and pwd commands are two separate commands, they are usually used together. cd stands for change directory and pwd stands for print working directory. You use pwd command to check the directory you are working in. You can change this directory using cd command. By default, current working directory is the one where the connection was established.

The syntaxes of pwd and cd commands in meterpreter are as follows:

pwd

cd

checksum: This command retrieves the checksum of a file. The syntax of checksum command is as follows:

checksum [md5/sha1] file1 file2 file 3...

cp: This command copies the content of source to destination. The syntax of cp command is as follows:

cp < newfile>

dir: This command lists files. It is an alias for the ls command. It provides crucial details related to any file or directories such as File Permissions, Size of File, Last modified date and file Name & Type. The syntax of dir command is as follows:

dir

download: This command downloads remote files and directories from remote location to the local machine. The syntax of download command is as follows:

download [options] src1 src 2 src3... destination

edit: This command edits a file. The syntax of edit command is as follows:

edit

When you press the Enter key, the screen displayed is as shown in the below image:

After editing the file, type :q! to save the changes and exit, as shown in the below image

getlwd: This command prints local working directory. The syntax of getlwd command is as follows:

getlwd

getwd: This command prints working directory. The syntax of getwd command is as follows:

getwd

lcd: This command changes local working directory. The syntax of lcd command is as follows:

lcd

You can see that local working directory changes to /root/Desktop

lls: This command lists local files. The syntax of ls command is as follows:

lls

lpwd: This command prints local working status. It is same as the getlwd command. The syntax of lpwd command is as follows:

lpwd

ls: This command lists files. The syntax of ls command is as follows:

ls

mkdir: This command makes directory. The syntax of mkdir command is as follows:

mkdir dir1 dir2 dir3...

mv: This command moves source to destination.  The syntax of mv command is as follows:

mv oldfile newfile

You can see the moved contents using cat command.

pwd: This command prints working directory. The syntax of pwd command is as follows:

pwd

rm: This command deletes the specified file. The syntax of rm file is as follows:

rm file1 [file2...]

You can see the list of files before and after using rm command.

rmdir: This command removes directory. The syntax of rmdir command is as follows:

rmdir dir1 dir 2 dir 3...

search: This command search for files. The syntax of search command is as follows:

search –f *.doc

show_mount: This command list all mount points/logical drives. The syntax of show_mount command is as follows:

show_mount

upload: This command uploads a file or directory. The syntax of upload command is as follows:

upload [options] src1 src2 src3... destination

You can see the uploaded file, as shown in the below image: