> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/winrm.md).

# Winrm

**WinRM** (Windows Remote Management) is a Microsoft protocol used for remote management and automation. It uses HTTP(S) over ports 5985 (HTTP) and 5986 (HTTPS) and allows remote command execution with valid credentials.

***

### Checking WinRM Port Availability

#### Nmap Scan

```bash
nmap -p 5985,5986 --open -sV <ip>
```

Look for services like:

```
5985/tcp open  http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
5986/tcp open  ssl/http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
```

***

### Exploiting with `Evil-WinRM`

`Evil-WinRM` is the most common tool for exploiting WinRM with valid credentials.

#### Install

```bash
gem install evil-winrm
```

#### Usage

```bash
evil-winrm -i <ip> -u <username> -p <password>
```

If using a password-protected key:

```bash
evil-winrm -i <ip> -u <username> -k id_rsa --pass-passphrase
```

You get a full interactive PowerShell session remotely.

***

### Brute-force WinRM

**Tools:**

* NetExec

#### NetExec (nxc)

```bash
nxc winrm <ip> -u usernames.txt -p passwords.txt
```