how to quit a shell gracefully?

[trklisted at networksamurai.org (mOses)]

In the meterpreter you will want to use the migrate <PID> command to  
migrate from one process to another. meterpreter > migrate PID

Within the Meterpreter itself you can use the ps command to list out  
all processes. meterpreter > ps

You also use getpid to get the processid you are in: meterpreter >   
getpid <PID>

A few things to note however.

Within a process running as the SYSTEM account. Although you have a  
high level of privelege you do not have any access to the GUI (like  
explorer) since you are not a 'user'.
You can migrate from SYSTEM to a <user> account, but be aware that the  
windows permissions will apply to you. If you migrate from a process  
running as  SYSTEM to a process running as Administrator you cannot go  
back to SYSTEM.
If you go from a process running as  Administrator to a process  
running as <user> then you cannot go back.

eye carrot meterpreter htough...

mOsesrenegade.


On May 27, 2009, at 10:43 PM, Jun Koi wrote:

> On Wed, May 13, 2009 at 9:34 AM, Jun Koi <junkoi2004 at gmail.com> wrote:
> > hi Rob,
> >
> > On Tue, May 12, 2009 at 10:08 PM, Rob Fuller <mubix at room362.com>  
> > wrote:
> > > Jun,
> > >    Lauri is right. However if you are trying to close the session  
> > > for good,
> > > you are going to crash the process that you are in. I believe this  
> > > is based
> > > on the EXITFUNC (Exit Function) that is used (SEH, Process, Thread).
> > >    But as a best practice, in my penetration testing, I migrate to  
> > > a service
> > > (if possible - depending on level of access) that is marked to  
> > > auto restart,
> >
> > This part is interesting! Could you explain how to "migrate" to  
> > another service?
> > Does "migrate" mean "injecting shell into another process"?
>
> A follow up question: could anybody explain how to "migrate" to
> another process once we are in (so we can be more stealthy)? Any
> command for that?
>
> Thanks a lot,
> J
> _______________________________________________
> https://mail.metasploit.com/mailman/listinfo/framework