# WinRM Service Discovery with NTLM Info

- **URL:** https://hackindex.io/services/winrm/enumeration/winrm-service-discovery-and-ntlm-info
- **Path:** WinRM > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/winrm/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-05-15

WinRM usually sits on **5985 (HTTP)** and **5986 (HTTPS)**. Even without creds, many setups will answer with an **NTLM challenge** that leaks NetBIOS names, DNS domain/FQDN, and a Windows build hint. That’s enough to decide whether you’re looking at a domain-joined target, how to set `$DOMAIN`, and what to prioritize next.

## Confirm WinRM ports

```bash
nmap -Pn -p 5985,5986 $TARGET_IP
```

What you’re looking for:

- **5985/tcp open**: WinRM over HTTP is reachable.
- **5986/tcp open**: WinRM over HTTPS is reachable.

If neither is open, WinRM isn’t exposed on the standard ports. Don’t assume it’s absent, some orgs remap it. Keep `$PORT` in mind if you saw it elsewhere.

## Pull NTLM info with Nmap

Basic probe:

```bash
nmap -Pn -p 5985,5986 --script http-ntlm-info $TARGET_IP
# | http-ntlm-info:
# |   Target_Name: ACTIVEWEB
# |   NetBIOS_Domain_Name: ACTIVEWEB
# |   NetBIOS_Computer_Name: WEB-TEST2
# |   DNS_Domain_Name: somedomain.com
# |   DNS_Computer_Name: web-test2.somedomain.com
# |   DNS_Tree_Name: somedomain.com
# |_  Product_Version: 6.1.7601
```

If you get nothing back, force the request to WinRM’s typical endpoint:

```bash
nmap -Pn -p 5985,5986 --script http-ntlm-info --script-args http-ntlm-info.root=/wsman $TARGET_IP
```

Combine with version detection when you want service context in one run:

```bash
nmap -Pn -p 5985,5986 -sV --script http-ntlm-info --script-args http-ntlm-info.root=/wsman $TARGET_IP
```

## Interpreting output

**DNS_Domain_Name present**

- Treat it as a strong “domain-joined” signal.
- Set `$DOMAIN` to the DNS domain and start using it consistently in other tooling.
- The **DNS_Computer_Name** gives you the FQDN you can drop into `/etc/hosts` if name resolution is flaky.

**Only NetBIOS names, no DNS domain**

- Often workgroup or non-domain configuration, or the service isn’t disclosing full DNS context.
- Plan for local-account validation paths and password reuse checks, not just domain auth assumptions.

**Product_Version looks old**

- It’s not a full OS fingerprint, but it’s a quick prioritization hint.
- If it suggests an older Windows build, shift effort to high-return Windows attack surface enumeration alongside WinRM.

**No http-ntlm-info output**

- Could be NTLM disabled, WinRM hardened, non-NTLM auth only, or the endpoint path isn’t `/`.
- Retry with `http-ntlm-info.root=/wsman`. If still blank, move on to endpoint probing and credential validation.

## What to do next

If you got domain/FQDN:

- Use `$DOMAIN` everywhere (Kerberos realm assumptions, AD recon, user format decisions).
- Feed hostnames into your target list for other service checks and certificate/hostname matching.

If you got a hostname but no domain:

- Add the NetBIOS computer name to notes for later correlation with SMB/LDAP/RDP naming.
- Focus next on WinRM endpoint probing and credential validation.

If 5986 is open:

- Pull the TLS cert details to see CN/SANs, which often confirm hostnames and internal domains.

## Variants

### Single non-standard port

If WinRM is suspected on a custom port:

```bash
nmap -Pn -p $PORT -sV --script http-ntlm-info --script-args http-ntlm-info.root=/wsman $TARGET_IP
```

### Scan a list of hosts fast

```bash
nmap -Pn -n --open -p 5985,5986 --script http-ntlm-info --script-args http-ntlm-info.root=/wsman -iL targets.txt -oA winrm-ntlm-info
```

This is mainly for harvesting `$DOMAIN` and hostnames across a subnet so you can pivot into service-specific validation.

### TLS certificate check on 5986

```bash
nmap -Pn -p 5986 --script ssl-cert $TARGET_IP
```

If the cert CN/SANs match an internal domain you didn’t have yet, use that to sanity-check the NTLM output and your `$DOMAIN` assumptions.

## Edge cases

### NTLM info only appears on `/wsman`

Some hosts won’t negotiate NTLM on `/` but will on WinRM’s endpoint. Use:

```bash
nmap -Pn -p 5985,5986 --script http-ntlm-info --script-args http-ntlm-info.root=/wsman $TARGET_IP
```

### Reverse proxies / WAF-like behavior

If you see inconsistent results between 5985 and 5986, treat them as different front doors. Pull NTLM info from both and keep the “best” hostname/domain data.

NTLM disclosure from WinRM also confirms conditions for relay: see [NTLM Relay Conditions](https://hackindex.io/platforms/active-directory/vulnerability-discovery/ntlm-relay-conditions). To test credentials against the endpoint, proceed to [WinRM Brute Force and Password Spray](https://hackindex.io/services/winrm/exploitation/brute-force-password-spray).

## References

- [http-ntlm-info NSE script](https://nmap.org/nsedoc/scripts/http-ntlm-info.html) - NTLM challenge extraction over HTTP services