What best describes Meterpreter in the context of post-exploitation?

• A. It is a simple command-line shell only for Windows.
• B. Meterpreter provides a specialized shell environment designed for attackers.
• C. It is a network sniffer platform.
• D. It is a read-only forensic tool.

Answer: (B)

Meterpreter is a post-exploitation payload that runs in memory on the compromised host and presents an interactive, feature-rich shell back to the attacker. It’s not just a plain command-line interface; it’s designed to be stealthy, with an encrypted channel to the attacker, and it can be extended with plugins to perform many actions without writing to disk. Capabilities include file operations, process migration, keylogging, screen capture, credential dumping, and pivoting to reach other systems. These characteristics make Meterpreter an attacker-focused tool for post-exploitation, rather than a simple Windows shell, a general network sniffer platform, or a read-only forensic tool.