# Exploitation

> Brute force, shell access, CLM bypass, and JEA escape guides

- **URL:** https://hackindex.io/services/winrm/exploitation
- **Service:** [WinRM](https://hackindex.io/services/winrm.md)
- **Tags:** initial-access, execution
- **Published:** 2026-03-12
- **Updated:** 2026-03-29

WinRM exploitation focuses on gaining interactive shell access through the Windows Remote Management service. With valid credentials, Evil-WinRM provides a full PowerShell session with built-in upload/download, in-memory .NET assembly loading, and AMSI bypass capabilities right out of the box.

Credential brute-forcing against WinRM is effective when lockout policies are weak. CrackMapExec and Hydra both support WinRM authentication spraying. Once credentials are confirmed, PowerShell remoting via Enter-PSSession or Invoke-Command gives you command execution, while Evil-WinRM adds pentesting-specific features like Donut shellcode injection and DLL loading.

The subpages cover credential attacks, shell establishment with different tools, and techniques for upgrading basic WinRM access into a more capable foothold on the target system.

## Guides

- [WinRM Brute Force and Password Spraying](https://hackindex.io/services/winrm/exploitation/brute-force-password-spray.md)
- [WinRM Cleartext Credential Capture – HTTP Traffic Interception](https://hackindex.io/services/winrm/exploitation/cleartext-credential-capture.md)
- [evil-winrm – Full WinRM Shell Usage Guide](https://hackindex.io/services/winrm/exploitation/evil-winrm.md): Exploit WinRM with evil-winrm for interactive PowerShell shells using credentials, hashes, SSL, file transfer, and in-memory script/assembly loading.