Skip to content
HackIndex logo

HackIndex

WinRM Endpoint Exposure Check

4 min read May 15, 2026

An open port 5985 or 5986 does not confirm a usable WinRM surface on its own. You need to confirm the WSMan endpoint is active, identify which authentication methods are advertised, and determine whether the listener is reachable from segments it should not be. This check is what justifies deeper authentication and access validation.

Confirm the Listener with Nmap

Start with a version scan against both ports:

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -sV -p 5985,5986 $TARGET_IP 
PORT     STATE SERVICE VERSION
5985/tcp open  http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
5986/tcp open  ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Explain command
-Pn Skip ping discovery, treat host as online
-sV Probe open ports to determine service versions
-p 5985,5986 Scan only ports 5985 (WinRM HTTP) and 5986 (WinRM HTTPS)
$TARGET_IP Target IP address variable

Microsoft-HTTPAPI/2.0 on either port confirms the WinRM listener is active. Run http-auth-finder to pull the authentication methods advertised by the service:

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 5985,5986 --script http-auth-finder $TARGET_IP 
5985/tcp open  http
| http-auth-finder:
|   url                  method
|_  http://10.10.10.5:5985/wsman   HTTP: Negotiate, NTLM, Basic
Explain command
-Pn Skip host discovery and treat host as online
-p 5985,5986 Scan specified ports (WinRM HTTP and HTTPS)
--script http-auth-finder Run http-auth-finder NSE script to find auth pages
$TARGET_IP Target IP address variable placeholder

Basic in the output is the key finding on port 5985. It means credentials would be sent in cleartext over unencrypted HTTP, which enables credential interception and direct password reuse. Negotiate and NTLM alone are expected and do not represent a misconfiguration by themselves.

Manual Endpoint Verification with curl

Fetch the WSMan endpoint headers directly to confirm the service and capture the auth surface:

┌──(kali㉿kali)-[~]
└─$ curl -s -D - -o /dev/null http://$TARGET_IP:5985/wsman
┌──(kali㉿kali)-[~]
└─$ curl -sk -D - -o /dev/null https://$TARGET_IP:5986/wsman 
HTTP/1.1 405 Method Not Allowed
Server: Microsoft-HTTPAPI/2.0
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
WWW-Authenticate: Basic realm="WSMAN"
Explain command
-s Silent mode; do not show progress meter or error information
-D - Dump response headers to stdout
-o /dev/null Write response body to /dev/null (discard output)
$TARGET_IP:5985 Target IP and port for HTTP WinRM connection
-sk Silent mode and skip SSL certificate verification
$TARGET_IP:5986 Target IP and port for HTTPS WinRM connection

A 405 Method Not Allowed or 401 Unauthorized response both confirm the WSMan endpoint is live. A 404 or connection refused means the listener is not active on that port. Save the WWW-Authenticate values and Server header for documentation.

Interpreting the Port Combination

The combination of open ports changes what to investigate next.

Both 5985 and 5986 open means HTTP and HTTPS listeners are running in parallel. This is common in environments that enabled WinRM without restricting the HTTP listener afterward. The HTTP side is always the priority because it exposes credentials and challenge material without TLS protection.

Only 5985 open means WinRM is running without HTTPS. Move immediately to authentication method validation. If Basic is advertised here, document it as a credential exposure risk. The HTTP-only configuration also means NTLM challenges are unprotected in transit.

Only 5986 open means the environment is HTTPS-only. Shift focus to TLS and certificate validation before assessing authentication methods. Check the WinRM HTTPS TLS Validation page for that workflow.

Scoping the Exposure

A WinRM listener reachable only from a dedicated management VLAN is a lower-severity finding than one reachable from user workstations, VPN pools, or the internet. Once you confirm the listener is active, check whether the port is reachable from outside the expected management network.

If the target is reachable from a broader network segment, the exposure itself becomes a finding independent of the authentication configuration. Pair it with the auth method findings for the full picture.

With the endpoint confirmed and auth methods identified, move to WinRM Brute Force and Password Spray for credential attacks, or AD Password Spraying for domain-wide coverage.

References