Skip to content
HackIndex logo

HackIndex

WinRM Service Discovery with NTLM Info

5 min read May 15, 2026

WinRM usually sits on 5985 (HTTP) and 5986 (HTTPS). Even without creds, many setups will answer with an NTLM challenge that leaks NetBIOS names, DNS domain/FQDN, and a Windows build hint. That’s enough to decide whether you’re looking at a domain-joined target, how to set $DOMAIN, and what to prioritize next.

Confirm WinRM ports

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 5985,5986 $TARGET_IP
Explain command
-Pn Skip ping; treat all hosts as online.
-p 5985,5986 Scan specified ports (WinRM HTTP and HTTPS).
$TARGET_IP Target host IP address or hostname to scan.

What you’re looking for:

  • 5985/tcp open: WinRM over HTTP is reachable.

  • 5986/tcp open: WinRM over HTTPS is reachable.

If neither is open, WinRM isn’t exposed on the standard ports. Don’t assume it’s absent, some orgs remap it. Keep $PORT in mind if you saw it elsewhere.

Pull NTLM info with Nmap

Basic probe:

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 5985,5986 --script http-ntlm-info $TARGET_IP 
| http-ntlm-info:
|   Target_Name: ACTIVEWEB
|   NetBIOS_Domain_Name: ACTIVEWEB
|   NetBIOS_Computer_Name: WEB-TEST2
|   DNS_Domain_Name: somedomain.com
|   DNS_Computer_Name: web-test2.somedomain.com
|   DNS_Tree_Name: somedomain.com
|_  Product_Version: 6.1.7601
Explain command
-Pn Skip host discovery and treat host as online
-p 5985,5986 Scan specific ports 5985 and 5986
--script http-ntlm-info Run http-ntlm-info NSE script to extract NTLM info
$TARGET_IP Target IP address variable placeholder

If you get nothing back, force the request to WinRM’s typical endpoint:

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 5985,5986 --script http-ntlm-info --script-args http-ntlm-info.root=/wsman $TARGET_IP
Explain command
-Pn Skip ping discovery; treat host as online.
-p 5985,5986 Scan specific ports: 5985 (WinRM HTTP) and 5986 (WinRM HTTPS).
--script http-ntlm-info Run NSE script to extract NTLM authentication information.
--script-args http-ntlm-info.root=/wsman Set script argument to test NTLM against /wsman endpoint.
$TARGET_IP Target IP address variable for scanning.

Combine with version detection when you want service context in one run:

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 5985,5986 -sV --script http-ntlm-info --script-args http-ntlm-info.root=/wsman $TARGET_IP
Explain command
-Pn Skip ping; treat all hosts as online.
-p 5985,5986 Scan specific ports 5985 and 5986.
-sV Probe open ports to determine service versions.
--script http-ntlm-info Run http-ntlm-info NSE script to extract NTLM info.
--script-args http-ntlm-info.root=/wsman Set script argument root path to /wsman for NTLM probe.
$TARGET_IP Target host IP address or hostname to scan.

Interpreting output

DNS_Domain_Name present

  • Treat it as a strong “domain-joined” signal.

  • Set $DOMAIN to the DNS domain and start using it consistently in other tooling.

  • The DNS_Computer_Name gives you the FQDN you can drop into /etc/hosts if name resolution is flaky.

Only NetBIOS names, no DNS domain

  • Often workgroup or non-domain configuration, or the service isn’t disclosing full DNS context.

  • Plan for local-account validation paths and password reuse checks, not just domain auth assumptions.

Product_Version looks old

  • It’s not a full OS fingerprint, but it’s a quick prioritization hint.

  • If it suggests an older Windows build, shift effort to high-return Windows attack surface enumeration alongside WinRM.

No http-ntlm-info output

  • Could be NTLM disabled, WinRM hardened, non-NTLM auth only, or the endpoint path isn’t /.

  • Retry with http-ntlm-info.root=/wsman. If still blank, move on to endpoint probing and credential validation.

What to do next

If you got domain/FQDN:

  • Use $DOMAIN everywhere (Kerberos realm assumptions, AD recon, user format decisions).

  • Feed hostnames into your target list for other service checks and certificate/hostname matching.

If you got a hostname but no domain:

  • Add the NetBIOS computer name to notes for later correlation with SMB/LDAP/RDP naming.

  • Focus next on WinRM endpoint probing and credential validation.

If 5986 is open:

  • Pull the TLS cert details to see CN/SANs, which often confirm hostnames and internal domains.

Variants

Single non-standard port

If WinRM is suspected on a custom port:

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p $PORT -sV --script http-ntlm-info --script-args http-ntlm-info.root=/wsman $TARGET_IP
Explain command
-Pn Skip ping discovery; treat all hosts as online.
-p $PORT Scan specified port(s) defined by variable $PORT.
-sV Detect service versions on open ports.
--script http-ntlm-info Run http-ntlm-info NSE script to extract NTLM info.
--script-args http-ntlm-info.root=/wsman Pass argument to script specifying root path /wsman.
$TARGET_IP Target host IP address to scan.

Scan a list of hosts fast

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -n --open -p 5985,5986 --script http-ntlm-info --script-args http-ntlm-info.root=/wsman -iL targets.txt -oA winrm-ntlm-info
Explain command
-Pn Skip ping discovery; treat all hosts as online.
-n Disable DNS resolution for faster scanning.
--open Only display open ports in output.
-p 5985,5986 Scan only ports 5985 and 5986 (WinRM).
--script http-ntlm-info Run the http-ntlm-info NSE script.
--script-args http-ntlm-info.root=/wsman Set http-ntlm-info script argument to /wsman path.
-iL targets.txt Read target hosts from targets.txt file.
-oA winrm-ntlm-info Output results in all formats with basename winrm-ntlm-info.

This is mainly for harvesting $DOMAIN and hostnames across a subnet so you can pivot into service-specific validation.

TLS certificate check on 5986

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 5986 --script ssl-cert $TARGET_IP
Explain command
-Pn Skip ping discovery, treat all hosts as online
-p 5986 Scan only port 5986 (WinRM HTTPS)
--script ssl-cert Run ssl-cert NSE script to extract SSL certificate info
$TARGET_IP Target IP address to scan

If the cert CN/SANs match an internal domain you didn’t have yet, use that to sanity-check the NTLM output and your $DOMAIN assumptions.

Edge cases

NTLM info only appears on /wsman

Some hosts won’t negotiate NTLM on / but will on WinRM’s endpoint. Use:

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 5985,5986 --script http-ntlm-info --script-args http-ntlm-info.root=/wsman $TARGET_IP
Explain command
-Pn Skip ping discovery; treat all hosts as online.
-p 5985,5986 Scan only ports 5985 and 5986.
--script http-ntlm-info Run the http-ntlm-info NSE script to extract NTLM info.
--script-args http-ntlm-info.root=/wsman Set script argument to query /wsman URI path.
$TARGET_IP Target host IP address to scan.

Reverse proxies / WAF-like behavior

If you see inconsistent results between 5985 and 5986, treat them as different front doors. Pull NTLM info from both and keep the “best” hostname/domain data.

NTLM disclosure from WinRM also confirms conditions for relay — see NTLM Relay Conditions. To test credentials against the endpoint, proceed to WinRM Brute Force and Password Spray.

References