Evil-WinRM

Evil-WinRM (Hackplayers) is the de-facto third-party WinRM shell for penetration testing. Written in Ruby, it wraps the WinRM protocol (TCP 5985/5986) in a pentester-friendly interactive shell with features the native clients lack: NTLM pass-the-hash authentication, certificate-based auth, SSL support, colored output, command history, and in-memory PowerShell script loading that bypasses AMSI-adjacent on-disk detection by never touching the target’s disk. ¹

Authentication with an NTLM hash

The killer feature: passwordless login when you only have the user’s NT hash (e.g. from a secrets dump — see netcat for the shell you’d typically upgrade to):

evil-winrm -i $TARGET_HOST \
           -u $TARGET_USER \
           -H $TARGET_USER_NTLM_HASH

This maps to MITRE T1550.002 (Use Alternate Authentication Material: Pass the Hash) over T1021.006 (WinRM) — one of the most common lateral-movement pairings in Windows estates, since WinRM accepts NTLM by default and the UAC token filter doesn’t apply to domain accounts.

File transfer caveat

Evil-WinRM ships built-in upload / download commands, but transfers are chunked through the WinRM channel and are notably slow for large payloads. For bulk exfiltration or payload staging, prefer standing up an SMB share or HTTP server and pulling from the target instead. ²

Key capabilities (per upstream README)

• Plaintext password, NTLM hash, and private-key/certificate authentication
• upload / download with remote path autocompletion
• services listing, menu-driven post-exploitation helpers
• Invoke-Binary style in-memory execution of .NET assemblies via the -s scripts and -e executables paths
• Docker image available for dependency-free use

Detection

WinRM session telemetry is client-agnostic — WinRM detection applies wholesale: WinRM/Operational EID 91, PowerShell 4104 script-block logging, and anomalous 5985/5986 flows. Evil-WinRM’s user-agent and Kerberos-vs-NTLM negotiation patterns are fingerprintable on the wire where TLS is offloaded or 5985 is in use.

Sources

• Evil-WinRM
• MITRE ATT&CK T1550.002 — Pass the Hash
• Remote Services: Windows Remote Management

Related: windows-remote-management, wmi-remote-service-execution, ntlm-hashes, active-directory-lateral-movement, amsi-bypass, dcerpc, exploit-windows-services

Footnotes

1. Evil-WinRM ↩

2. Evil-WinRM ↩