Post Exploitation
Evil-WinRM is a dedicated tool for executing commands via the Windows Remote Management (WinRM) protocol. It serves as an exploit shell alternative during penetration testing engagements.
sudo gem install evil-winrm
evil-winrm -i <target_ip> -u <user> -p <password>
Evil-WinRM is the ultimate WinRM client for penetration testers, providing an interactive PowerShell-like shell on remote Windows systems. It enables efficient lateral movement and post-exploitation through the Windows Remote Management protocol.
With built-in support for pass-the-hash authentication, file upload/download, and custom extension loading, Evil-WinRM streamlines remote Windows access during security assessments.
evil-winrm -i 10.10.10.10 -u <USER> -p <PASS>Connect to a Windows host over WinRM with a username and passwordevil-winrm -i 10.10.10.10 -u <USER> -H <NTLM_HASH>Authenticate using a pass-the-hash NTLM hash instead of a passwordevil-winrm -i 10.10.10.10 -u <USER> -p <PASS> -SConnect using HTTPS/SSL WinRM (port 5986)evil-winrm -i 10.10.10.10 -u <USER> -p <PASS> --port 5986 -SSpecify a custom port and enable SSLevil-winrm -i 10.10.10.10 -u <USER> -p <PASS> -s /path/to/scriptsSet a local scripts directory to load PowerShell scripts fromevil-winrm -i 10.10.10.10 -u <USER> -p <PASS> -e /path/to/exesSet a local executables directory for the Invoke-Binary featureevil-winrm -i 10.10.10.10 -u <USER> -p <PASS> -r example.comUse Kerberos authentication with the given realmevil-winrm -i 10.10.10.10 -u <USER> -p <PASS> --spn HTTPSet the SPN prefix for Kerberos authenticationevil-winrm -i 10.10.10.10 -u <USER> -p <PASS> -c /path/to/cert.pem -k /path/to/key.pemAuthenticate with an SSL client certificate and private keyevil-winrm -i 10.10.10.10 -u <USER> -p <PASS> -lEnable logging of the session to a fileevil-winrm -i 10.10.10.10 -u <USER> -p <PASS> -nDisable colored outputevil-winrm -i 10.10.10.10 -u <USER> -p <PASS> -NDisable remote path completionupload /path/to/file C:\Windows\Temp\fileMenu command: upload a local file to the remote hostdownload C:\Users\Administrator\Desktop\flag.txt /path/to/fileMenu command: download a remote file to the local machineservicesMenu command: list Windows services and their vulnerable permissionsGet interactive PowerShell on Windows targets.
Pivot between Windows hosts via WinRM.
Upload/download files to/from target.
Load custom PowerShell scripts dynamically.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.