In a real world situation, you would either alter the source to require authentication, or filter out remote connections to the port through some other method.
We exploit the remote system and migrate to the 'Explorer.exe' process in case the user notices the exploited service is not responding and decides to kill it.