Metasploit Windows Post Capture Modules {Computer Forensics Tutorial}

Now Open Kali Linux terminal type msfconsole

Once you got the meterpreter session

keylog_recorder

The "keylog_recorder" post module captures keystrokes on the compromised system. Note that you will want to ensure that you have migrated to an interactive process prior to capturing keystrokes.

After we have finished sniffing keystrokes, or even while the sniffer is still running, we can dump the captured data.