I tested the existing migrate64.py but for some reason was not producing any output even though there was a print statement. After adding my own print statements and using VSCode Debugger, I was able to identify the cause. The problem was because the script was checking if "explorer.exe" existed in each line of the output from
ps command.As shown in the screenshot below, you can see that not all letters of explorer.exe are on the same line:
The last character e was on a different line, hence why the script was unable to find "explorer.exe" and failed to migrate. To fix this issue, I changed the script to check if "explorer" existed instead of "explorer.exe".
I also added success/fail print statements. If migration was successfully, the script will print out
[*] Session has successfully migrated!. If migration was unsuccessful, the script will print out [*] Session failed to migrate!.You can view the codes to my modified migrate64.py in this link: https://github.com/real-yj98/Attack-Automation/blob/master/pythonTTP/stage3/internalC2/windows/migrate64.py