WinRM (Windows Remote Management) is Microsoft's implementation of the WS-Management protocol, listening on TCP 5985 (HTTP) and 5986 (HTTPS), and it is a transport behind PowerShell Remoting. It is a useful lateral-movement and remote-execution target on Windows networks when an account is authorized for a session endpoint. Passwords and, where NTLM is enabled, NT hashes may authenticate the connection. The resulting session runs in the authenticated user's context and remains subject to operating-system permissions and endpoint restrictions; successful remoting does not itself grant administrator rights.
nmap -p5985,5986 -sV <target>
nxc winrm <target> -u user -p 'pass' # validates creds and flags Pwn3d! (admin)
Subtopics#
- Enumeration: detecting WinRM and its configuration.
- Authentication: passwords, NTLM, and pass-the-hash.
- Command execution: obtaining a shell with Evil-WinRM and PowerShell Remoting.