# WinRM Endpoint Exposure Check

- **URL:** https://hackindex.io/services/winrm/vulnerability-discovery/winrm-endpoint-exposure-check
- **Path:** WinRM > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/winrm/vulnerability-discovery.md)
- **Published:** 2026-03-06
- **Updated:** 2026-05-15

An open port 5985 or 5986 does not confirm a usable WinRM surface on its own. You need to confirm the WSMan endpoint is active, identify which authentication methods are advertised, and determine whether the listener is reachable from segments it should not be. This check is what justifies deeper authentication and access validation.

## Confirm the Listener with Nmap

Start with a version scan against both ports:

```bash
nmap -Pn -sV -p 5985,5986 $TARGET_IP
# PORT     STATE SERVICE VERSION
# 5985/tcp open  http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
# 5986/tcp open  ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
```

`Microsoft-HTTPAPI/2.0` on either port confirms the WinRM listener is active. Run `http-auth-finder` to pull the authentication methods advertised by the service:

```bash
nmap -Pn -p 5985,5986 --script http-auth-finder $TARGET_IP
# 5985/tcp open  http
# | http-auth-finder:
# |   url                  method
# |_  http://10.10.10.5:5985/wsman   HTTP: Negotiate, NTLM, Basic
```

`Basic` in the output is the key finding on port 5985. It means credentials would be sent in cleartext over unencrypted HTTP, which enables credential interception and direct password reuse. `Negotiate` and `NTLM` alone are expected and do not represent a misconfiguration by themselves.

## Manual Endpoint Verification with curl

Fetch the WSMan endpoint headers directly to confirm the service and capture the auth surface:

```bash
curl -s -D - -o /dev/null http://$TARGET_IP:5985/wsman
curl -sk -D - -o /dev/null https://$TARGET_IP:5986/wsman
# HTTP/1.1 405 Method Not Allowed
# Server: Microsoft-HTTPAPI/2.0
# WWW-Authenticate: Negotiate
# WWW-Authenticate: NTLM
# WWW-Authenticate: Basic realm="WSMAN"
```

A `405 Method Not Allowed` or `401 Unauthorized` response both confirm the WSMan endpoint is live. A `404` or connection refused means the listener is not active on that port. Save the `WWW-Authenticate` values and `Server` header for documentation.

## Interpreting the Port Combination

The combination of open ports changes what to investigate next:

- **Both 5985 and 5986 open**: HTTP and HTTPS listeners running in parallel. Common when WinRM was enabled without restricting the HTTP listener. The HTTP side is the priority because it exposes credentials without TLS.
- **Only 5985 open**: WinRM without HTTPS. Move to auth method validation immediately. If Basic is advertised, document it as credential exposure. NTLM challenges are also unprotected in transit.
- **Only 5986 open**: HTTPS-only. Shift focus to TLS and certificate validation before assessing auth methods. Check the WinRM HTTPS TLS Validation page for that workflow.

## Scoping WinRM Endpoint Exposure

A WinRM listener reachable only from a dedicated management VLAN is a lower-severity finding than one reachable from user workstations, VPN pools, or the internet. Once you confirm the listener is active, check whether the port is reachable from outside the expected management network.

If the target is reachable from a broader network segment, the exposure itself becomes a finding independent of the authentication configuration. Pair it with the auth method findings for the full picture.

With the endpoint confirmed and auth methods identified, move to [WinRM Brute Force and Password Spray](https://hackindex.io/services/winrm/exploitation/brute-force-password-spray) for credential attacks, or [AD Password Spraying](https://hackindex.io/platforms/active-directory/exploitation/ad-password-spraying) for domain-wide coverage.

## References

- [http-headers NSE Script](https://nmap.org/nsedoc/scripts/http-headers.html) - Capture HTTP response headers
- [Installation and configuration for WinRM](https://learn.microsoft.com/en-us/windows/win32/winrm/installation-and-configuration-for-windows-remote-management) - Listener defaults and ports