Windows Remote Management
ID: T1028 Tactic: Execution, Lateral Movement
Windows Remote Management (WinRM) is the name of both a Windows Service and a protocol that allows a user to interact with a remote system (e.g., run an executable modify the Registry, modify services). It may be called with the
winrmcommand or by any number of programs such as PowerShell.
Without the use of PowerShell Code execution can be accomplished with the following syntax.
winrs -r:DESKTOP-DELTA.dc1.dominioncyber.local -u:Adrian -p:Dathura1 calc.exe
Here is a demo on the Lateral Movement executing.
PowerShell Remoting is essentially a native Windows remote command execution feature that's build on top of the Windows Remote Management (WinRM) protocol.
Now a simple demonstration I use the following syntax to simple create a remote PS-Session on the targeted machine.
Enumeration here says, that I am the user John and the workstation DESKTOP-CHARLIE. I wrote a small
Then on my Delta machine I have a small file on the Desktop with the user John logged in.
A login windows is prompt to enter the credentials.
Once successfully entered the credentials a PS Session is started on the remote host.
And I can grab the proof.txt file contents