> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/connect-to-machines/evil-winrm.md).

# Evil-WinRM

Evil-WinRM is the ultimate WinRM shell for hacking/pentesting.

## Connect

Connect with a username and password

```bash
evil-winrm -u administrator -p badminton -i 10.129.203.80
```

Connect with a username and NTLM-hash

```bash
evil-winrm -i 192.168.187.70 -u Administrator -H 38d752daa3155c266d029d32b13bc351
```

## Usage information

<details>

<summary>evil-winrm -h</summary>

```
┌──(kali㉿kali)-[~/Desktop]
└─$ evil-winrm -h                                   
                                        
Evil-WinRM shell v3.5

Usage: evil-winrm -i IP -u USER [-s SCRIPTS_PATH] [-e EXES_PATH] [-P PORT] [-p PASS] [-H HASH] [-U URL] [-S] [-c PUBLIC_KEY_PATH ] [-k PRIVATE_KEY_PATH ] [-r REALM] [--spn SPN_PREFIX] [-l]
    -S, --ssl                        Enable ssl
    -c, --pub-key PUBLIC_KEY_PATH    Local path to public key certificate
    -k, --priv-key PRIVATE_KEY_PATH  Local path to private key certificate
    -r, --realm DOMAIN               Kerberos auth, it has to be set also in /etc/krb5.conf file using this format -> CONTOSO.COM = { kdc = fooserver.contoso.com }
    -s, --scripts PS_SCRIPTS_PATH    Powershell scripts local path
        --spn SPN_PREFIX             SPN prefix for Kerberos auth (default HTTP)
    -e, --executables EXES_PATH      C# executables local path
    -i, --ip IP                      Remote host IP or hostname. FQDN for Kerberos auth (required)
    -U, --url URL                    Remote url endpoint (default /wsman)
    -u, --user USER                  Username (required if not using kerberos)
    -p, --password PASS              Password
    -H, --hash HASH                  NTHash
    -P, --port PORT                  Remote host port (default 5985)
    -V, --version                    Show version
    -n, --no-colors                  Disable colors
    -N, --no-rpath-completion        Disable remote path completion
    -l, --log                        Log the WinRM session
    -h, --help                       Display this help message

```

</details>

## Resources

Evil-WinRM - GitHub: <https://github.com/Hackplayers/evil-winrm>

evil-winrm - Kali Tools: <https://www.kali.org/tools/evil-winrm/>

Windows Remote Management - Wikipedia: <https://en.wikipedia.org/wiki/Windows_Remote_Management>