← Back to Academy

Academy Node

CanPSRemote

CanPSRemote means the user can likely open a PowerShell Remoting session to the target.

Beginner100 XPBloodHound Edge

Why it matters

In OSCP/HTB this often means direct shell via Evil-WinRM.

How to identify it

  • BloodHound CanPSRemote edge
  • NetExec WinRM success
  • Port 5985 open

BloodHound indicators

  • CanPSRemote

NetExec commands

nxc winrm 192.168.184.150 -d xutslabs.local -u USER -p PASS

Linux commands

evil-winrm -i 192.168.184.150 -u USER -p PASS

Expected output

  • Pwn3d!
  • Evil-WinRM prompt

Success looks like

  • Interactive PowerShell shell

Failure looks like

  • Access denied
  • WinRM disabled

Troubleshooting

  • Try FQDN/IP
  • Validate creds with LDAP first

Common mistakes

  • Only checking SMB
  • Forgetting domain

Alternative attacks

  • SMBExec
  • RDP
  • MSSQL shell

What to try next

  • Run whoami /all
  • Local privesc
  • BloodHound from new context

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.