WinRM:

Exploitation

Brute force, shell access, CLM bypass, and JEA escape guides

3 guides • Created Dec 28, 2025 • Updated Mar 29, 2026

3 guides

WinRM Brute Force and Password Spraying

Mar 12, 2026 • 4 min read

WinRM Cleartext Credential Capture – HTTP Traffic Interception

Mar 12, 2026 • 4 min read

evil-winrm – Full WinRM Shell Usage Guide

Exploit WinRM with evil-winrm for interactive PowerShell shells using credentials, hashes, SSL, file transfer, and in-memory script/assembly loading.

Mar 12, 2026 • 6 min read

WinRM exploitation focuses on gaining interactive shell access through the Windows Remote Management service. With valid credentials, Evil-WinRM provides a full PowerShell session with built-in upload/download, in-memory .NET assembly loading, and AMSI bypass capabilities right out of the box.

Credential brute-forcing against WinRM is effective when lockout policies are weak. CrackMapExec and Hydra both support WinRM authentication spraying. Once credentials are confirmed, PowerShell remoting via Enter-PSSession or Invoke-Command gives you command execution, while Evil-WinRM adds pentesting-specific features like Donut shellcode injection and DLL loading.

The subpages cover credential attacks, shell establishment with different tools, and techniques for upgrading basic WinRM access into a more capable foothold on the target system.