# WinRM

> WinRM is Windows remote management over HTTP/HTTPS. Attackers probe auth, brute force creds, gain remote shells, bypass CLM, escape JEA, and move laterally across Windows environments

- **URL:** https://hackindex.io/services/winrm
- **Type:** Service
- **Default ports:** 5985, 5986
- **Tags:** winrm, windows, remote-management, lateral-movement, credentials, powershell
- **Published:** 2025-12-31
- **Updated:** 2026-07-14

WinRM (Windows Remote Management) is Microsoft's implementation of the WS-Management protocol for remote administration of Windows systems. It runs on **TCP port 5985** for HTTP and **TCP port 5986** for HTTPS. Nmap identifies it as `wsman` or `http` with WinRM-specific responses.

WinRM is a primary lateral movement vector in Windows and Active Directory environments. It provides full PowerShell remoting capabilities, meaning valid credentials grant interactive command execution on the target. Tools like `evil-winrm`, `crackmapexec`, and PowerShell's `Enter-PSSession` use WinRM for post-exploitation access. It supports NTLM and Kerberos authentication, making it compatible with pass-the-hash and pass-the-ticket attacks.

Enumeration starts with checking whether WinRM is accessible and which authentication methods are accepted. Brute-forcing or spraying credentials against WinRM is effective because it supports local and domain accounts. Once credentials are obtained, WinRM provides a full interactive shell, file upload/download capabilities, and the ability to load PowerShell modules for further enumeration and privilege escalation.

## Phases

- [Enumeration](https://hackindex.io/services/winrm/enumeration.md): WinRM discovery, auth probing, cred validation, and config enum (5 guides)
- [Vulnerability Discovery](https://hackindex.io/services/winrm/vulnerability-discovery.md): Guides for finding WinRM misconfigs, weak TLS, and auth flaws (4 guides)
- [Exploitation](https://hackindex.io/services/winrm/exploitation.md): Brute force, shell access, CLM bypass, and JEA escape guides (3 guides)
- [Privilege Escalation](https://hackindex.io/services/winrm/privilege-escalation.md): Bypass CLM and escape JEA endpoints over WinRM sessions (2 guides)
- [Lateral Movement](https://hackindex.io/services/winrm/lateral-movement.md): Move across accounts or systems to expand reach. Use trust paths to access new assets. (1 guides)