Which payload is commonly used to establish an interactive remote session after gaining foothold on a Windows network?

• A. Shell
• B. DoublePulsar
• C. Shodan
• D. Meterpreter

Answer: (D)

The concept being tested is choosing a payload that provides a robust, interactive control channel after you’ve gained a foothold on a Windows host. Meterpreter is designed exactly for that role. It runs in memory, creates an interactive session with a secure, encrypted channel back to the attacker, and offers a rich set of post‑exploitation features. Those features include file system access, process migration, keylogging, screen capture, credential access, and extendable modules, all through one interactive session. This makes it much more versatile and controllable than a simple shell.

A basic shell can give you command access, but it lacks the built‑in capabilities, stealth, and modularity of Meterpreter. DoublePulsar, meanwhile, is a backdoor/loader used to compromise and enable further payloads; it’s not aimed at providing an interactive session itself. Shodan is a search engine for internet‑accessible devices and has no role in establishing remote control over a foothold.

So, Meterpreter is the best fit for establishing an interactive remote session after gaining foothold on a Windows network.