pentesting-winrm

name	pentesting-winrm
description	Testing Windows Remote Management (WinRM / WS-Management) during authorized engagements. WinRM exposes an HTTP(S) SOAP interface for WMI/PowerShell remoting on 5985/tcp (HTTP) and 5986/tcp (HTTPS). Covers service detection with Test-WSMan and netexec, credential validation and brute force, interactive shells with evil-winrm (password, pass-the-hash, Kerberos, certificate auth), command execution, NTLM relay to WS-MAN, and the OMIGOD (CVE-2021-38647) RCE.
domain	cybersecurity
subdomain	network-services-pentesting
tags	["penetration-testing","network-services","winrm","windows","lateral-movement","command-execution"]
version	1.0
author	xalgorix
license	Apache-2.0

Pentesting WinRM (port 5985/5986)

When to Use

• During authorized Windows/AD assessments when 5985 (HTTP) or 5986 (HTTPS) is open
• When you hold valid credentials or an NT hash and want an interactive remote shell
• When testing for NTLM relay opportunities against an unencrypted WinRM (HTTP) listener
• When assessing Azure Linux hosts running OMI (OMIGOD, CVE-2021-38647)
• When validating credentials at scale and checking which grant remote-exec

Quick Enumeration

# Port presence implies WinRM is configured
nmap -p5985,5986 -sV <IP>
# 5985/tcp Microsoft-HTTPAPI ; 5986/tcp is HTTPS

# From Windows: confirm a target is WinRM-configured
Test-WSMan <target-ip>        # returns protocol version + wsmid if configured

# netexec / crackmapexec credential check (no interactive shell)
crackmapexec winrm <IP> -u <user> -p <password> -x "whoami"
crackmapexec winrm <IP> -d <Domain> -u <user> -H <HASH> -X '$PSVersionTable'

# Shodan-style discovery
# port:5985 Microsoft-HTTPAPI

Critical: Checks Most Often Missed

1. Valid creds ≠ WinRM access — a user must be in the Remote Management Users group (or local admins). Always confirm with crackmapexec winrm before assuming evil-winrm will work; a green (+) with (Pwn3d!) indicates exec.
2. Unencrypted HTTP listener (5985) → NTLM relay — since impacket 0.11, ntlmrelayx.py can relay captured NTLM to WS-MAN/WinRM for SYSTEM-level code execution. Combine with mitm6/Responder coercion.
3. OMIGOD (CVE-2021-38647) — Azure Linux agents run OMI exposing WS-MAN on 5985/5986; a logic flaw allows unauthenticated RCE as root by omitting the auth header.
4. Pass-the-Hash works — evil-winrm authenticates with an NT hash (-H), no cleartext needed.
5. Kerberos / certificate auth — evil-winrm 3.x supports -k/--spn (Kerberos) and --cert-pem/--key-pem (certificate) for NTLM-disabled or cert-required environments.
6. Brute force locks accounts — WinRM brute forcing increments the bad-password counter; coordinate with the client and prefer validated single attempts.