Meterpreter

The exploit lands and you see meterpreter >. That prompt is worth more than a plain $. Meterpreter is Metasploit's own payload, an in-memory agent that runs inside the exploited process and speaks an encrypted protocol back to your console. It never touches disk as a file, and it gives you file transfer, screenshots, credential dumping, and pivoting from one interface.

Compare that to a netcat shell, which is just a raw command prompt piped over TCP. That plain shell drops if the connection hiccups, has no upload command, and paints your commands in cleartext across the wire. Meterpreter fixes all three. When you have a choice of payload, choose Meterpreter.

Sessions are your inventory

Every successful callback becomes a numbered session. You can hold several at once, drop back to the console to launch another attack, and jump between them freely. That is why background matters: it parks the current Meterpreter without killing it and returns you to the msf6 prompt.

The first five minutes on a box

Once you're in, a short routine tells you who you are and what you can do. Run these in order and you'll know your footing before you touch anything sensitive.

• getuid prints the account you're running as. NT AUTHORITY\SYSTEM means you already own the box; a service account means you have escalation work to do.
• sysinfo gives the OS, build, and architecture, which decides what escalation exploits apply.
• getprivs lists the privileges your token holds, like SeImpersonatePrivilege, a direct path to SYSTEM.
• pwd and ls orient you in the filesystem so you know where you landed.

Moving files and yourself

Meterpreter has built-in file transfer, so you never juggle a Python web server just to pull one file. download grabs a file to your Kali box, upload pushes one to the target, and shell drops you into a native cmd or bash when you need a tool Meterpreter doesn't wrap.

If your session is running inside a fragile process, like a browser that might close, migrate into something stable such as explorer.exe or winlogon.exe. Find a target PID with ps, then migrate 1084. Do this early, because losing the process means losing the session.