WinRM

WinRM

WinRM implements WS-Management on TCP 5985 (HTTP) and 5986 (HTTPS), providing remote management through PowerShell Remoting. Successful authentication can yield a shell under the account's existing privileges, subject to endpoint authorization and session constraints.

1분 분량2026년 10월 21일 업데이트

기여자 1명

WinRM (Windows Remote Management) is Microsoft's implementation of the WS-Management protocol, listening on TCP 5985 (HTTP) and 5986 (HTTPS), and it is a transport behind PowerShell Remoting. It is a useful lateral-movement and remote-execution target on Windows networks when an account is authorized for a session endpoint. Passwords and, where NTLM is enabled, NT hashes may authenticate the connection. The resulting session runs in the authenticated user's context and remains subject to operating-system permissions and endpoint restrictions; successful remoting does not itself grant administrator rights.

bash

nmap -p5985,5986 -sV <target>
nxc winrm <target> -u user -p 'pass'           # validates creds and flags Pwn3d! (admin)

Subtopics#

Enumeration: detecting WinRM and its configuration.
Authentication: passwords, NTLM, and pass-the-hash.
Command execution: obtaining a shell with Evil-WinRM and PowerShell Remoting.

Subtopics#

References#