December 2017
Intermediate to advanced
860 pages
16h 1m
English
As we saw in the previous section, our meterpreter session was loaded from a temporary file. However, if a user of a target system finds the process unusual, he can kill the process, which will kick us out of the system. Therefore, it is a good practice to migrate to safer processes, such as explorer.exe or svchost.exe, which evades the eyes of the victim by using the migrate command. However, we can always use the ps command to figure out the PID of the process we want to jump to, as shown in the following screenshot:

We can see that the PID of explorer.exe is 1896. Let us use the migrate command to jump into ...
Read now
Unlock full access