logo

MeterSSH - Meterpreter over SSH

ID: 8ae5844d-6a5e-5e08-ace1-ba1ec70e16b0

STIX ID: report--8ae5844d-6a5e-5e08-ace1-ba1ec70e16b0

Feed Name: TrustedSec blog

Threat Score
70/100

Date Published: 2025-03-19

Date Updated: 2026-05-01

...
...

This report documents MeterSSH, a Python-based tool that injects Meterpreter shellcode into memory on a target, binds a Meterpreter listener to port 8021, and tunnels the session back to an attacker via an SSH connection using Paramiko; it also includes a monitor script that detects the SSH tunnel and automatically launches Metasploit. The writeup provides configuration fields, deployment notes (including recommending packaging as an executable), and highlights that memory injection plus SSH tunneling can evade signature-based next-generation firewalls.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.