WinRM:
Lateral Movement
Move across accounts or systems to expand reach. Use trust paths to access new assets.
WinRM Lateral Movement
Exploiting Windows Remote Management (WinRM) for lateral movement using tools like Evil-WinRM, CrackMapExec, and PowerShell remoting.
WinRM lateral movement leverages PowerShell remoting to hop between hosts using harvested credentials or Kerberos tickets. Enter-PSSession gives you an interactive shell on the remote host, while Invoke-Command executes scripts across multiple targets simultaneously, making it one of the fastest lateral movement methods in a Windows domain.
Credential reuse is the primary vector. NTLM hashes work with Evil-WinRM's pass-the-hash support, and Kerberos tickets obtained through Rubeus or Mimikatz enable authentication without the plaintext password. When WinRM is allowed through the firewall between segments, it provides a clean lateral path that blends in with legitimate admin traffic.
The subpages cover remote session management, credential-based and ticket-based authentication for pivoting, JEA (Just Enough Administration) bypass techniques, and strategies for chaining WinRM sessions across multiple network segments.