> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/lat-mov/remote-commands/remote-commands-via-winrm.md).

# Remote Commands via WinRM

Windows Remote Management (WinRM) is the [Microsoft](https://en.wikipedia.org/wiki/Microsoft) implementation of the [DMTF](https://en.wikipedia.org/wiki/DMTF)-standard [WS-Management](https://en.wikipedia.org/wiki/WS-Management). It allows accessing or exchanging management information across a common network. Utilizing scripting objects or the built-in command-line tool, WinRM can be used with any remote computers that may have [baseboard management controllers (BMCs)](https://en.wikipedia.org/wiki/Intelligent_Platform_Management_Interface#Baseboard_management_controller) to acquire data. On Windows-based computers including WinRM, certain data supplied by [Windows Management Instrumentation (WMI)](https://en.wikipedia.org/wiki/Windows_Management_Instrumentation) can also be obtained.

## Remote commands with crackmapexec

Se examples from HackTricks, link below

Also add NetExec!

## Remote commands with Evil-WinRM

Connect with a username and password

```bash
evil-winrm -u administrator -p badminton -i 10.129.203.80
```

Connect with a username and NTLM-hash

```bash
evil-winrm -i 192.168.187.70 -u Administrator -H 38d752daa3155c266d029d32b13bc351
```

### Built-in commands in Evil-WinRM

Evil-WinRM has a number of [built-in commands](https://github.com/Hackplayers/evil-winrm#basic-commands)

* download
* menu
* services
* upload

### Usage information

<details>

<summary>evil-winrm -h</summary>

```bash
┌──(kali㉿kali)-[~/Desktop]
└─$ evil-winrm -h                                   
                                        
Evil-WinRM shell v3.5

Usage: evil-winrm -i IP -u USER [-s SCRIPTS_PATH] [-e EXES_PATH] [-P PORT] [-p PASS] [-H HASH] [-U URL] [-S] [-c PUBLIC_KEY_PATH ] [-k PRIVATE_KEY_PATH ] [-r REALM] [--spn SPN_PREFIX] [-l]
    -S, --ssl                        Enable ssl
    -c, --pub-key PUBLIC_KEY_PATH    Local path to public key certificate
    -k, --priv-key PRIVATE_KEY_PATH  Local path to private key certificate
    -r, --realm DOMAIN               Kerberos auth, it has to be set also in /etc/krb5.conf file using this format -> CONTOSO.COM = { kdc = fooserver.contoso.com }
    -s, --scripts PS_SCRIPTS_PATH    Powershell scripts local path
        --spn SPN_PREFIX             SPN prefix for Kerberos auth (default HTTP)
    -e, --executables EXES_PATH      C# executables local path
    -i, --ip IP                      Remote host IP or hostname. FQDN for Kerberos auth (required)
    -U, --url URL                    Remote url endpoint (default /wsman)
    -u, --user USER                  Username (required if not using kerberos)
    -p, --password PASS              Password
    -H, --hash HASH                  NTHash
    -P, --port PORT                  Remote host port (default 5985)
    -V, --version                    Show version
    -n, --no-colors                  Disable colors
    -N, --no-rpath-completion        Disable remote path completion
    -l, --log                        Log the WinRM session
    -h, --help                       Display this help message
```

</details>

## Remote commands with winrs.exe

Windows remote Management using the `winrs.exe` command enables you to manage and execute programs remotely. It uses TCP port 5986 for encrypted HTTPS traffic and port 5985 for plain HTTP.

You can execute remote command with `winrs.exe` as follows

```batch
C:\Users\fcastle>winrs.exe -r:hydra-dc -u:fcastle -p:P@ssW0rd! "cmd /c hostname & whoami"
Hydra-DC
marvel\fcastle
```

Note that `winrs.exe` seems to be very picky with quotes!

```batch
C:\Users\fcastle>winrs.exe -r:hydra-dc -u:fcastle -p:"P@ssW0rd!"  "cmd /c hostname & whoami"

Winrs error:The user name or password is incorrect.
```

The command support both Windows style parameters (`/r`) and Unix style parameter (`-r`) and both short format (`/r`) and long format (`/remote`).

## Resources

Pentesting WinRM - HackTricks: <https://book.hacktricks.wiki/en/network-services-pentesting/5985-5986-pentesting-winrm.html>

Windows Remote Management - Wikipedia: <https://en.wikipedia.org/wiki/Windows_Remote_Management>

WinRS - Tool Analysis Result Sheet - JPCERT/CC: <https://jpcertcc.github.io/ToolAnalysisResultSheet/details/WinRS.htm>

winrs - Microsoft Learn: <https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs>

WS-Management - - Wikipedia: <https://en.wikipedia.org/wiki/WS-Management>