5985,5986 - WinRM

Authentication

Password-based

evil-winrm -i <ip> -u <user> -p <pass>

Pass-the-Hash

Certificate & Key

AMSI Bypass

1. Check

> #amsiscanbuffer
At line:1 char:1
+ #amsiscanbuffer
+ ~~~~~~~~~~~~~~~
This script contains malicious content and has been blocked by your antivirus software.

# Try this as well
> set-mppreference —disablerealtimemonitoring $true

2. Bypass

3. Confirm

PowerShell Remoting

PowerShell Remoting by default uses WinRM for Cmdlets such as Enter-PSSession. Therefore, a user needs to be in the local group Remote Management Users to be a valid user for these Cmdlets. However, instead of WinRM, SSH can also be used for PowerShell remoting.

Creating a PowerShell remoting session via WinRM in a bind shell can cause unexpected behavior. Opt for evil-winrm instead.

> $password = ConvertTo-SecureString "qwertqwertqwert123!!" -AsPlainText -Force

> $cred = New-Object System.Management.Automation.PSCredential("daveadmin", $password)

> Enter-PSSession -ComputerName CLIENTWK220 -Credential $cred
[CLIENTWK220]: PS C:\Users\daveadmin\Documents> whoami
whoami
clientwk220\daveadmin