Skip to content
HackIndex logo

HackIndex

WinRM Endpoint Probing

6 min read May 15, 2026

WinRM endpoint probing confirms the service is present, identifies what authentication methods are advertised, determines whether the listener is native WinRM or fronted by IIS, and extracts hostname and certificate information. This is the first step before any credential validation or vulnerability checks.

Port and Service Detection

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -sV -p 5985,5986 $TARGET_IP 
5985/tcp open  http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
5986/tcp open  ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Explain command
-Pn Skip ping discovery; treat host as online
-sV Probe open ports to determine service versions
-p 5985,5986 Scan only specified ports (WinRM HTTP and HTTPS)
$TARGET_IP Target host IP address variable

Microsoft HTTPAPI/2.0 on either port confirms a WinRM listener is active. If only 5985 is open, WinRM is running over plain HTTP. If only 5986 is open, it is HTTPS only. Both open means HTTP and HTTPS listeners are running in parallel.

For subnet-wide discovery of hosts with WinRM open:

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 5985,5986 --open $TARGET_IP/24
Explain command
-Pn Skip ping discovery and treat all hosts as online.
-p 5985,5986 Scan only specified ports (WinRM HTTP and HTTPS).
--open Only display open ports in results.
$TARGET_IP/24 Target network range in CIDR notation (subnet of 256 hosts).

Probe the WSMan Endpoint

WinRM listens on /wsman by default. A direct HTTP request returns the authentication methods and confirms the endpoint is active:

┌──(kali㉿kali)-[~]
└─$ curl -s -D - -o /dev/null http://$TARGET_IP:5985/wsman
┌──(kali㉿kali)-[~]
└─$ curl -sk -D - -o /dev/null https://$TARGET_IP:5986/wsman 
HTTP/1.1 405 Method Not Allowed
Server: Microsoft-HTTPAPI/2.0
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
Date: Mon, 10 Mar 2025 12:34:56 GMT
Explain command
-s Silent mode; suppress progress meter and error information.
-D - Dump HTTP headers to stdout instead of file.
-o /dev/null Write output to /dev/null, discarding response body.
http://$TARGET_IP:5985/wsman Target URL with variable placeholder for IP address.
-k Allow insecure SSL/TLS connections without certificate verification.
https://$TARGET_IP:5986/wsman Target HTTPS URL with variable placeholder for IP address.

A 405 Method Not Allowed or 401 Unauthorized with Microsoft-HTTPAPI/2.0 confirms an active WSMan endpoint. A 404 on /wsman means either the listener is not active on that port or the path differs. Try / to check for a redirect:

┌──(kali㉿kali)-[~]
└─$ curl -s -D - -o /dev/null http://$TARGET_IP:5985/
Explain command
-s Silent mode; suppress progress meter and error information
-D - Dump headers to stdout
-o /dev/null Write output to /dev/null (discard response body
$TARGET_IP:5985 Target IP address and port for WinRM HTTP service

Read the Authentication Methods

The WWW-Authenticate header lists every method the service accepts. Pull only the relevant headers:

┌──(kali㉿kali)-[~]
└─$ curl -s -D - -o /dev/null http://$TARGET_IP:5985/wsman | grep -i "WWW-Authenticate\|Server:"
Explain command
-s Silent mode; suppress progress meter and error information
-D - Write headers to stdout instead of a file
-o /dev/null Write response body to /dev/null (discard output)
$TARGET_IP:5985/wsman Target URL with IP variable and WinRM service endpoint
-i Case-insensitive matching for grep filter

What each value indicates:

Negotiate — Kerberos is available. Tooling falls back to NTLM automatically when Kerberos negotiation fails.

NTLM — challenge-response over NTLM works. The NTLM challenge also leaks domain name and computer name without completing authentication, covered in WinRM Service Discovery with NTLM Info.

Basic — credentials are base64-encoded. On 5985 over plain HTTP, Basic authentication exposes credentials on the wire. This is a vulnerability finding covered in WinRM Basic Auth Detection.

No WWW-Authenticate header — either not a WinRM endpoint, or a proxy is stripping the challenge.

Confirm Native WinRM vs IIS

The Server header distinguishes native WinRM from an IIS-hosted configuration:

┌──(kali㉿kali)-[~]
└─$ curl -s -D - -o /dev/null http://$TARGET_IP:5985/wsman | grep -i "^Server:"
Explain command
-s Silent mode; suppresses progress meter and error information.
-D - Dumps HTTP headers to stdout instead of a file.
-o /dev/null Writes response body to /dev/null, discarding it.
http://$TARGET_IP:5985/wsman Target URL with variable IP address on WinRM port 5985.

Microsoft-HTTPAPI/2.0 is the native WinRM HTTP listener. Microsoft-IIS/10.0 or similar means WinRM is hosted behind IIS, which may produce different path behaviour and additional auth layers.

Nmap HTTP and Method Scripts

Nmap's HTTP scripts can confirm the endpoint and check what HTTP methods the service accepts:

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 5985,5986 --script http-methods,http-title $TARGET_IP
Explain command
-Pn Skip ping scan; treat all hosts as online
-p 5985,5986 Scan only ports 5985 and 5986
--script http-methods,http-title Run http-methods and http-title NSE scripts
$TARGET_IP Target IP address or hostname to scan

This is useful when curl returns ambiguous responses — http-title sometimes clarifies whether you are hitting a WinRM endpoint or an unrelated web service on the same port.

TLS Certificate Names on 5986

The certificate on port 5986 reveals the intended hostname and often exposes internal FQDNs in the Subject Alternative Names:

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 5986 --script ssl-cert $TARGET_IP 
| ssl-cert:
|   Subject: commonName=WORKSTATION01.corp.local
|   Subject Alternative Name: DNS:WORKSTATION01, DNS:WORKSTATION01.corp.local
Explain command
-Pn Skip ping probe; treat host as online
-p 5986 Scan only port 5986
--script ssl-cert Run ssl-cert NSE script to extract SSL certificate info
$TARGET_IP Target IP address or hostname to scan

Use the CN or SAN value as the hostname in tools that validate certificate names. This also gives the internal domain name without any Active Directory queries.

To check via openssl:

┌──(kali㉿kali)-[~]
└─$ openssl s_client -connect $TARGET_IP:5986 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName
Explain command
-connect $TARGET_IP:5986 Connect to target IP on port 5986 (WinRM HTTPS)
-noout Suppress certificate output, show only parsed data
-subject Display the certificate subject distinguished name
-ext subjectAltName Display the Subject Alternative Name extension

Redirect Detection

Some environments redirect 5985 to 5986 or to a specific FQDN. Follow redirects to detect this:

┌──(kali㉿kali)-[~]
└─$ curl -s -D - -o /dev/null -L http://$TARGET_IP:5985/wsman | grep -i "Location:\|HTTP/"
Explain command
-s Silent mode; suppresses progress meter and error messages.
-D - Dump headers to stdout instead of a file.
-o /dev/null Write response body to /dev/null, discarding it.
-L Follow HTTP redirects automatically.
http://$TARGET_IP:5985/wsman Target URL with variable placeholder for IP and WinRM port.

If a redirect points to an internal hostname, that name must resolve correctly for authentication to succeed. Add it temporarily:

┌──(kali㉿kali)-[~]
└─$ echo "$TARGET_IP $DOMAIN" | sudo tee -a /etc/hosts

Once auth methods are identified, validate credentials with WinRM Credential Validation. For password attacks against the endpoint, see WinRM Brute Force and Password Spray.

References