Skip to main content

Evil-WinRM

WinRM (Windows Remote Management)​

WinRM is a Microsoft protocol that enables remote management of Windows machines using SOAP-based communication. It allows administrators to execute commands, manage processes, and retrieve data remotely via the Windows Management Instrumentation (WMI) service.

Evil-WinRM​

Evil-WinRM is a specialized penetration testing tool designed to interact with the WinRM service efficiently. It provides a user-friendly interface for executing commands, uploading files, and accessing remote shells on Windows systems with valid credentials. If the login is successful with Evil-WinRM, a terminal session is initialized using the PowerShell Remoting Protocol (MS-PSRP), which simplifies the operation and execution of commands.

Installing Evil-WinRM​

sudo gem install evil-winrm

Example Use​

evil-winrm -i <target-IP> -u <username> -p <password>

# Pass The Pass
evil-winrm -i 10.10.10.10 -u username -p password

# Pass The Hash
evil-winrm -i 10.10.10.10 -u Administrator -H bdeaf6b3c9fbd4c1a1e765e63a50d52b