> For the complete documentation index, see [llms.txt](https://dmcxblue.gitbook.io/red-team-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dmcxblue.gitbook.io/red-team-notes/lateral-movement/windows-remote-management.md).

# Windows Remote Management

Windows Remote Management (WinRM) is the name of both a Windows Service and a protocol that allows a user to interact with a remote system (e.g., run an executable modify the Registry, modify services). It may be called with the `winrm` command or by any number of programs such as PowerShell.

### WinRS

Without the use of PowerShell Code execution can be accomplished with the following syntax.

```
winrs -r:DESKTOP-DELTA.dc1.dominioncyber.local -u:Adrian -p:Dathura1 calc.exe
```

{% hint style="info" %}
WinRm is a great option when credentials needs to be placed when a shell from your attacking box, since the prompt never tends to show unless you have an RDP session
{% endhint %}

Here is a demo on the Lateral Movement executing.

![](/files/-M-J6ImD_pkXAZl_NSey)

### PSRemoting

PowerShell Remoting is essentially a native Windows remote command execution feature that's build on top of the Windows Remote Management (WinRM) protocol.

{% hint style="info" %}
This feature is not set by default, it needs Admin privileges on the local and remote machine this is supported by Windows Vista with Service Pack 1 or later, Windows 7, Windows Server 2008, and Windows Server 2012 and after.
{% endhint %}

Now a simple demonstration I use the following syntax to simple create a remote PS-Session on the targeted machine.

Enumeration here says, that I am the user John and the workstation DESKTOP-CHARLIE. I wrote a small `proof.txt`

![Charlie machine](/files/-M-LUG7wIka4bO7Es2Uz)

Then on my Delta machine I have a small file on the Desktop with the user John logged in.

![Delta](/files/-M-LY3hjfw5sGA8GWMSo)

A login windows is prompt to enter the credentials.

![](/files/-M-LY_VP_RRMZjlkpHTd)

Once successfully entered the credentials a PS Session is started on the remote host.

![](/files/-M-LYmkWtFkGiIr02en1)

And I can grab the proof.txt file contents

![](/files/-M-LZ-zg0JRW1OXYCJO1)

**Demo:**

![](/files/-M-La6L1YRKPTTmoQair)

References:

{% embed url="<https://blog.netspi.com/powershell-remoting-cheatsheet/>" %}