WinRM

WinRM

WinRM implements WS-Management on TCP 5985 (HTTP) and 5986 (HTTPS), providing remote command execution on Windows through PowerShell Remoting. The surface is service enumeration, authentication with passwords or NTLM hashes (pass-the-hash), and command execution: valid credentials or a hash for a Remote Management user yield an interactive shell, typically with administrative rights.

1 phút đọccập nhật 7 thg 10, 2026

1 người đóng góp

WinRM (Windows Remote Management) is Microsoft's implementation of the WS-Management protocol, listening on TCP 5985 (HTTP) and 5986 (HTTPS), and it is a transport behind PowerShell Remoting. It is a useful lateral-movement and remote-execution target on Windows networks when an account is authorized for a session endpoint. Passwords and, where NTLM is enabled, NT hashes may authenticate the connection. The resulting session runs in the authenticated user's context and remains subject to operating-system permissions and endpoint restrictions; successful remoting does not itself grant administrator rights.

bash

nmap -p5985,5986 -sV <target>
nxc winrm <target> -u user -p 'pass'           # validates creds and flags Pwn3d! (admin)

Subtopics#

Enumeration: detecting WinRM and its configuration.
Authentication: passwords, NTLM, and pass-the-hash.
Command execution: obtaining a shell with Evil-WinRM and PowerShell Remoting.

Subtopics#

References#