Windows Remote Management

ID: T1028 Tactic: Execution, Lateral Movement

Windows Remote Management (WinRM) is the name of both a Windows Service and a protocol that allows a user to interact with a remote system (e.g., run an executable modify the Registry, modify services). It may be called with the winrm command or by any number of programs such as PowerShell.

WinRS

Without the use of PowerShell Code execution can be accomplished with the following syntax.

winrs -r:DESKTOP-DELTA.dc1.dominioncyber.local -u:Adrian -p:Dathura1 calc.exe

WinRm is a great option when credentials needs to be placed when a shell from your attacking box, since the prompt never tends to show unless you have an RDP session

Here is a demo on the Lateral Movement executing.

PSRemoting

PowerShell Remoting is essentially a native Windows remote command execution feature that's build on top of the Windows Remote Management (WinRM) protocol.

This feature is not set by default, it needs Admin privileges on the local and remote machine this is supported by Windows Vista with Service Pack 1 or later, Windows 7, Windows Server 2008, and Windows Server 2012 and after.

Now a simple demonstration I use the following syntax to simple create a remote PS-Session on the targeted machine.

Enumeration here says, that I am the user John and the workstation DESKTOP-CHARLIE. I wrote a small proof.txt

Charlie machine

Then on my Delta machine I have a small file on the Desktop with the user John logged in.

Delta

A login windows is prompt to enter the credentials.

Once successfully entered the credentials a PS Session is started on the remote host.

And I can grab the proof.txt file contents

Demo:

References:

PowerShell Remoting CheatsheetNetSPI