Is it possible to remove a Metasploit payload/meterpreter from a compromised system? My question is mainly based on antiforensics (Leaving aside Memory forensics which is probably unavoidable but more advanced).

Does the Kill command take care of that?


Meterpreter never touches the disk. So until you don't do anything deliberately that changes resources on the hard drive and leave evidence, chances are there will be no evidence on the disk. However, this is not so simple. OS can transfer pages from memory to disk when the system is low on memory. Although meterpreter reflective loader code specifically requests the OS not to flush the page to the disk where the meterpreter process is hosted, it's only a process request which can be ignored by the OS.

I am not going to explain the network part since it is out of scope here but a lot of times evidence is gathered from the network logs as well. SSL won't provide any benefit if it is intercepted in the middle (you have the option of certificate pinning in the stager code) but the bottom line is if you are concerned about forensics, make sure you are covered on all sides.

| improve this answer | |
  • Many metasploit payloads may touch disk prior to loading meterpreter – KDEx Jan 7 '16 at 19:34
  • @Morgoroth Can you clarify more what you mean? Only a single payload is injected in the exploited process through reflective DLL injection and at no point does it touches the disk. – void_in Jan 8 '16 at 4:52
  • 1
    I prolly should have said module instead of payload. If a module is not a memory corruption exploit then a stager might be used to deliver the meterpeter payload (e.g. tomcat but there are many better examples) that first bit of transferred data will touch disk and 'may' remain. – KDEx Jan 8 '16 at 6:47
  • 1
    That's right. The register_file_for_cleanup method deletes the uploaded file once it is loaded in memory. However, in some cases it remains on the disk. In such cases it is always ensured to tell the user that he needs to manually cleanup. However, I believe we should pass an additional argument to the register_file_for_cleanup method to make sure the file is securely wiped rather than just deleting it. Thanks for your input. – void_in Jan 8 '16 at 7:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.