WinRM enumeration
Confirm WinRM is running and brute-force credentials for remote Windows management access.
bash·1 min read··INE Certification
WinRM (Windows Remote Management) isn’t enabled by default, so finding it listening at all is a mild signal that the host is set up for remote administration. That usually makes remote command execution a very good possibility if anything is misconfigured.
| Port | Transport |
|---|---|
| 5985 | HTTP |
| 5986 | HTTPS |
Discover
nmap -sS -sV -p5985,5986 <target_ip> # 5985 = HTTP, 5986 = HTTPSBrute-force
crackmapexec winrm <target_ip> -u username.txt -p passwords.txtWith valid credentials
crackmapexec winrm <target> -u <user> -p <pass> -x "<command>" gives you remote command execution directly, or evil-winrm gets you a full interactive shell.
Related
- WinRM exploitation: brute-force and remote command execution
- CrackMapExec: protocol swiss-army knife
- Nmap: port and service scanning