skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pentesting-winrm

Tests WinRM services for credential access, remote shells, NTLM relay, and OMIGOD RCE.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#lateral movement#pass-the-hash#winrm#Active Directory#NTLM relay#evil-winrm
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-winrm
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentesting-winrm
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-services-pentesting/pentesting-winrm
Command: npx skills add https://github.com/xalgord/xalgorix --skill pentesting-winrm

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized Windows and Active Directory assessments, testers need a structured methodology to enumerate, authenticate to, and exploit Windows Remote Management (WinRM/WS-Management) on ports 5985/5986 without missing critical checks like NTLM relay exposure or unauthenticated OMI RCE.

Core Features & Use Cases

  • Service Detection and Credential Validation: Confirm WinRM configuration with Test-WSMan and validate credentials or NT hashes at scale using netexec/crackmapexec, including remote-exec capability checks.
  • Interactive Shells and Command Execution: Establish evil-winrm sessions via password, pass-the-hash, Kerberos, or certificate authentication, plus one-off command execution and PowerShell remoting from Linux with pypsrp.
  • Advanced Attack Paths: Relay coerced NTLM authentication to unencrypted WS-MAN listeners with ntlmrelayx.py and test Azure Linux OMI instances for OMIGOD (CVE-2021-38647) unauthenticated RCE.
  • Use Case: A pentester holding a dumped local admin NT hash uses evil-winrm pass-the-hash to obtain an interactive PowerShell shell on a target, then documents the access with evidence and remediation guidance in the structured finding format.

Quick Start

Ask the AI to enumerate and test WinRM on an authorized target at 192.168.1.10 using the pentesting-winrm skill, starting with port detection and credential validation.

Frequently Asked Questions about pentesting-winrm

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I get a shell with WinRM using a password hash?▼

Use evil-winrm with the -H flag to pass an NT hash instead of a cleartext password: evil-winrm -i <IP> -u <user> -H <NTHASH>. This yields an interactive PowerShell session without needing the original password.

How do I check if credentials have WinRM remote execution access?▼

Run crackmapexec winrm <IP> -u <user> -p <password> to validate credentials. A (Pwn3d!) marker in the output confirms remote command execution capability; valid credentials alone do not guarantee access since the user must be in Remote Management Users or local admins.

Can I use WinRM from Linux without Windows PowerShell?▼

Yes. evil-winrm provides interactive shells from Linux, and the pypsrp Python library supports WinRM/PS-Remoting with CredSSP and Kerberos authentication for scripted command execution.

Does evil-winrm support Kerberos and certificate authentication?▼

Yes, evil-winrm 3.x supports Kerberos via -k/--spn after obtaining a TGT with kinit, and certificate authentication via --cert-pem/--key-pem flags, useful in environments where NTLM is disabled.

Why is WinRM brute forcing risky during an engagement?▼

WinRM brute forcing increments the bad-password counter and can lock out accounts. Coordinate with the client, prefer validated single attempts, and use targeted spraying rather than aggressive brute force.

What is OMIGOD and how does it affect WinRM testing?▼

OMIGOD (CVE-2021-38647) is an unauthenticated remote code execution flaw in Azure's OMI agent, which exposes WS-MAN on ports 5985/5986. A crafted request omitting the auth header executes commands as root on vulnerable Azure Linux hosts.

Related Skills

Explore More Software Engineering Skills→
AeonDaveAeonDave
15

evil-winrm

Establish an interactive WinRM shell with pass-the-hash and file transfer.

Community
Intermediate
hardw00thardw00t
90

network-pentest

Simulate attacker techniques across internal networks and Active Directory environments.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

auth-coercion-relay

Automates PetitPotam, PrinterBug and DFSCoerce authentication coercion attacks with NTLM/Kerberos relay to SMB, LDAP, AD CS targets.

Official
Advanced
Prohao42Prohao42
120

windows-lateral-movement

Execute lateral movement techniques on Windows systems for penetration testing.

Community
Advanced