Establish an interactive WinRM shell with pass-the-hash and file transfer.
npx skills add https://github.com/AeonDave/malskill --skill evil-winrm
Please help me install this Agent Skill. Skill: evil-winrm Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/windows/evil-winrm Command: npx skills add https://github.com/AeonDave/malskill --skill evil-winrm
This Skill provides an interactive command-line interface for remote management of Windows hosts using the WinRM protocol, enabling efficient execution of commands and file transfers.
Connect to the Windows host at 192.168.1.10 using the username 'administrator' and password 'Password123'.
High-intent search queries and answers about installing and using this skill.
To get an interactive WinRM shell, connect to the target Windows host over port 5985 or 5986. This provides a command-line interface to execute commands and transfer files remotely.
Yes, you can use pass-the-hash and pass-the-ticket for WinRM authentication. It supports NTLM and Kerberos credential handling, allowing access without needing a plaintext password.
You can upload and run PowerShell scripts remotely by establishing a WinRM session. The shell supports file upload/download between local and remote systems to execute your tools.
Windows remote management via WinRM does not strictly require SSL, but it is supported. You can connect over standard port 5985 or use SSL on port 5986 for encrypted sessions.
The primary prerequisite for a WinRM shell is having WinRM enabled on the target Windows host. The remote management service must be accessible on port 5985 or 5986.
Using WinRM for remote management is highly effective for Windows environments because it natively supports PowerShell execution, file transfers, and credential delegation like pass-the-hash.
djcyphersExecute remote commands on Windows servers via WinRM, PowerShell remoting, and SSH.
AllBeingsFutureExecute shell commands with configurable working directory and timeout.
flybirdxxGuide red team operations using the MITRE ATT&CK framework.
Prohao42Guide reverse and bind shell selection with encrypted and web shell techniques.
