Windows Remote Management
ID: T1028 Tactic: Execution, Lateral Movement
Windows Remote Management (WinRM) is the name of both a Windows Service and a protocol that allows a user to interact with a remote system (e.g., run an executable modify the Registry, modify services). It may be called with the winrm command or by any number of programs such as PowerShell.
WinRS
Without the use of PowerShell Code execution can be accomplished with the following syntax.
WinRm is a great option when credentials needs to be placed when a shell from your attacking box, since the prompt never tends to show unless you have an RDP session
Here is a demo on the Lateral Movement executing.
PSRemoting
PowerShell Remoting is essentially a native Windows remote command execution feature that's build on top of the Windows Remote Management (WinRM) protocol.
This feature is not set by default, it needs Admin privileges on the local and remote machine this is supported by Windows Vista with Service Pack 1 or later, Windows 7, Windows Server 2008, and Windows Server 2012 and after.
Now a simple demonstration I use the following syntax to simple create a remote PS-Session on the targeted machine.
Enumeration here says, that I am the user John and the workstation DESKTOP-CHARLIE. I wrote a small proof.txt
Then on my Delta machine I have a small file on the Desktop with the user John logged in.
A login windows is prompt to enter the credentials.
Once successfully entered the credentials a PS Session is started on the remote host.
And I can grab the proof.txt file contents
Demo:
References:
Last updated
