← Back to Academy

Academy Node

WinRM Access

WinRM provides remote PowerShell access when the user is allowed to log in remotely.

Beginner100 XPLateral Movement

Why it matters

On OSCP and HTB, valid WinRM often means direct shell access.

How to identify it

  • Port 5985 or 5986 open.
  • NetExec shows WinRM success.
  • User is in Remote Management Users or local Administrators.

BloodHound indicators

  • CanPSRemote
  • AdminTo

NetExec commands

nxc winrm 192.168.184.150 -d xutslabs.local -u ba_low -p 'Password123'

PowerView commands

Find-PSRemotingLocalAdminAccess -ComputerName SRV01

Linux commands

evil-winrm -i 192.168.184.150 -u ba_low -p 'Password123'

Expected output

  • Pwn3d!
  • Evil-WinRM shell prompt

Success looks like

  • Interactive PowerShell shell.

Failure looks like

  • Access denied.
  • WinRM disabled.
  • Firewall blocked.

Troubleshooting

  • Try local hostname.
  • Check DNS.
  • Try IP and FQDN.
  • Validate SMB/LDAP first.

Common mistakes

  • Only testing SMB.
  • Missing domain prefix.
  • Assuming valid creds mean WinRM access.

Alternative attacks

  • SMB exec
  • RDP
  • MSSQL xp_cmdshell

What to try next

  • Run whoami /all.
  • Enumerate local privileges.
  • Check BloodHound from host context.

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.