Common meterpreter commands

• background — background the current session and return to the Metasploit console
• clearenv — clears the (Windows) event logs (kinda obvious)
• creds_all — dump all user credentials in memory (requires the kiwi module)
• download — transfer a file from the target to the attacker
• edit — edit a file
• getpid — get current process ID
• getprivs — display current user privileges
• getsystem — attempt to elevate to SYSTEM/root
• getuid — get current process user
• golden_ticket_create — create a golden ticket (requires the kiwi module)
• guid — get session ID
• hashdump — dump NLTM hashes from the SAM (Windows-only, requires system privileges); fields are username, RID (the last four digits of the Windows SID, with leading zeros dropped), LM password hash, NTLM password hash
• ifconfig — display host network interface information
• info — get information about a meterpreter extension
• load — load meterpreter extension
• load kiwi — load Mimikatz extension
• migrate — migrate meterpreter to another process
• netstat — display host network connections
• portfwd — forward a port on the host
• route — mess with the host routing tables
• run — run a meterpreter extension
• search — search for files
• sessions — switch to another (Metasploit) session
• shell — drop to system shell (return to meterpreter using CTRL + Z)
• sysinfo — pull remote system information
• upload — transfer a file from the attacker to the target

meterpreter sessions can be backgrounded using the background command, and all sessions can be backgrounded using CTRL + Z. List sessions using the sessions command, and foreground a session using session -i #, where # is the session number.

The sessions command is also used to connect to meterpreter sessions that have been caught after a successfully executed exploit.