security enabled verified high v1.0.0

evil-winrm

WinRM shell for remote Windows administration and post-exploitation, supporting plaintext, pass-the-hash, and Kerberos PKINIT authentication.

📋 Live Preview 
evil-winrm -i {target} -u {username} -p {password}
🌍 target → ip 🌍 username → user 📎 password 
evil-winrm -i {target} -u {username} -p {password}

Sandbox: execFile · Timeout: 300s

Capabilities

security.exec.winrm
security.credential.pth
security.lateral.winrm
security.ad.krbauth

Parameters

Name Type Required Default Description Aliases
target string Yes - Target IP address or hostname -
username string Yes - Username for authentication -
password string No - Password for plaintext auth -
hash string No - NTLM hash for pass-the-hash -
certificate file No - Public certificate file (PKINIT) -
private-key file No - Private key file (PKINIT) -

Contract

Inputs

network.target.ip

Target IP address

credential.username

Windows username

credential.password

Plaintext password or NTLM hash

Outputs

shell.session

Interactive WinRM shell session

Side effects: network_trafficraw_socket_access

Workflow Edges

Produces

shell.session

Consumes

network.target.ipcredential.usernamecredential.password

Resource Profile

ResourceValue
CPUlow
Memory64 MB
Networklow
Disk I/Olow

Examples

Basic WinRM shell with password authentication

evil-winrm -i 10.10.10.1 -u john -p password123

Pass-the-hash authentication

evil-winrm -i 10.10.10.1 -u john -H <NThash>

PKINIT certificate authentication

evil-winrm -i 10.10.10.1 -c pub.pem -k priv.pem -S -r EVILCORP

Authentication with SSL and relay domain

evil-winrm -i {{DOMAIN}} -u {{USER}} -p '{{PASSWORD}}'

Kerberos-based authentication

evil-winrm -i {{DC.DOMAIN}} -k -u {{USER}} -r {{DOMAIN}}

Documentation

evil-winrm — WinRM Shell for Pentesting

evil-winrm provides an interactive PowerShell session on Windows targets via WinRM. It supports multiple authentication methods including plaintext, pass-the-hash (NTLM), and Kerberos PKINIT.

Key Features

  • Upload/download files to/from the target
  • Pass-the-hash with NTLM hash
  • PKINIT authentication with certificates
  • Scripts loading from local and remote sources
  • Dynamic command completion for common Windows tools

Authentication Methods

Method Flags Use Case
Password -u user -p pass Plaintext credentials
Pass-the-Hash -u user -H <NThash> NTLM hash without password
PKINIT -c cert -k key -r domain Certificate-based authentication

Dependencies

ruby

Related Tools

netexecimpacketpsexec

References