WinRM

WinRM (Windows Remote Management) is Microsoft's implementation of the WS-Management protocol for remote administration of Windows systems. It runs on TCP port 5985 for HTTP and TCP port 5986 for HTTPS. Nmap identifies it as wsman or http with WinRM-specific responses.

WinRM is a primary lateral movement vector in Windows and Active Directory environments. It provides full PowerShell remoting capabilities, meaning valid credentials grant interactive command execution on the target. Tools like evil-winrm, crackmapexec, and PowerShell's Enter-PSSession use WinRM for post-exploitation access. It supports NTLM and Kerberos authentication, making it compatible with pass-the-hash and pass-the-ticket attacks.

Enumeration starts with checking whether WinRM is accessible and which authentication methods are accepted. Brute-forcing or spraying credentials against WinRM is effective because it supports local and domain accounts. Once credentials are obtained, WinRM provides a full interactive shell, file upload/download capabilities, and the ability to load PowerShell modules for further enumeration and privilege escalation.