Pentesting WinRM

Overview

• Windows Remote Management

• Ports: TCP 5985 (HTTP), TCP 5986 (HTTPS)

• Uses SOAP-based XML protocol

• Integrated into PowerShell Remoting

Scanning

nmap -sV -sC 10.129.201.248 -p5985,5986 --disable-arp-ping -n

Evil-WinRM

evil-winrm -i 10.129.201.248 -u Cry0l1t3 -p P455w0rD!

Validate Access with NetExec

netexec winrm TARGET -d DOMAIN.LOCAL -u USER -p 'PASSWORD'
netexec winrm TARGET -u LOCALUSER -H NTLM_HASH --local-auth

For paired username/password lists, avoid accidental password spraying by using --no-bruteforce:

netexec winrm targets.txt -d DOMAIN.LOCAL -u users.txt -p passwords.txt --no-bruteforce

Valid RDP credentials do not guarantee WinRM access. WinRM requires the account to be allowed to use PowerShell remoting, so test both protocols separately.

PowerShell Test

Test-WsMan <hostname>

WMI (TCP 135)

• Windows Management Instrumentation

• Uses TCP 135 for initial connection, then random high port

• Allows reading/writing to all Windows settings, triggering actions, remote code execution

WMIexec.py (Impacket)

/usr/share/doc/python3-impacket/examples/wmiexec.py Cry0l1t3:"P455w0rD!"@10.129.201.248 "hostname"