> For the complete documentation index, see [llms.txt](https://book.ice-wzl.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.ice-wzl.xyz/recon-enumeration/pentesting-winrm.md).

# Pentesting WinRM

## Overview

* Windows Remote Management
* Ports: TCP 5985 (HTTP), TCP 5986 (HTTPS)
* Uses SOAP-based XML protocol
* Integrated into PowerShell Remoting

## Scanning

```
nmap -sV -sC 10.129.201.248 -p5985,5986 --disable-arp-ping -n
```

## Evil-WinRM

```
evil-winrm -i 10.129.201.248 -u Cry0l1t3 -p P455w0rD!
```

## Validate Access with NetExec

```bash
netexec winrm TARGET -d DOMAIN.LOCAL -u USER -p 'PASSWORD'
netexec winrm TARGET -u LOCALUSER -H NTLM_HASH --local-auth
```

For paired username/password lists, avoid accidental password spraying by using `--no-bruteforce`:

```bash
netexec winrm targets.txt -d DOMAIN.LOCAL -u users.txt -p passwords.txt --no-bruteforce
```

Valid RDP credentials do not guarantee WinRM access. WinRM requires the account to be allowed to use PowerShell remoting, so test both protocols separately.

## PowerShell Test

```powershell
Test-WsMan <hostname>
```

## WMI (TCP 135)

* Windows Management Instrumentation
* Uses TCP 135 for initial connection, then random high port
* Allows reading/writing to all Windows settings, triggering actions, remote code execution

### WMIexec.py (Impacket)

```
/usr/share/doc/python3-impacket/examples/wmiexec.py Cry0l1t3:"P455w0rD!"@10.129.201.248 "hostname"
```