> For the complete documentation index, see [llms.txt](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/enumeration/enumerating-winrm.md).

# Enumerating Winrm

**1. Enumerating WinRM:**

* **Test Connectivity:**
  * `Test-WSMan`: Use this PowerShell command to test basic connectivity to the WinRM service.
  * `winrs -r:http://TARGET:PORT/wsman -u:USERNAME -p:PASSWORD dir C:\`: Use this WinRS command for testing with provided credentials.
  * `evil-winrm`: A popular Ruby-based tool for quick WinRM enumeration. Install it if not already available in Kali.
* **Nmap Scripts:**
  * `nmap -p5985,5986 TARGET`: Scan for open WinRM ports. You might need to add the `-sV` option for version detection.
* **Metasploit Modules:**
  * `use auxiliary/scanner/winrm/winrm_login`: Metasploit module for brute-force attacks against WinRM.

**2. Brute-Force and Password Attacks:**

* **Hydra:** Use the `hydra` tool to perform brute-force attacks on WinRM. Here's an example:
  * `hydra -s PORT -L users.txt -P passwords.txt -t 4 TARGET winrm`
* **CrackMapExec (CME):** An extensive post-exploitation tool with WinRM support. Install it if not already available in Kali.

**3. WinRM Client Tools:**

* **winrs**: A Windows-native command-line utility for interacting with WinRM services.
* **evil-winrm**: Ruby-based WinRM shell that provides a simple interface for enumeration and exploitation.

**4. Common Enumerations:**

* **PowerShell:** Once you have authenticated, you can use PowerShell to enumerate various aspects of the system. For example:
  * `Get-NetLocalGroup`: List local groups on the target.
  * `Get-NetUser`: Enumerate users.
  * `Get-NetShares`: List accessible shares.
  * `Get-NetSession`: List active sessions.
  * `Get-NetLoggedon`: List logged-on users.

**5. Exploitation:**

* **Metasploit:** If you have valid credentials, Metasploit provides modules for post-exploitation activities.

**6. CrackMapExec (CME):**

* `cme smb TARGET` and then `winrm` to switch to WinRM. CME has various post-exploitation modules.

**7. GitHub Repositories:**

* **Evil-WinRM:** GitHub repository for Evil-WinRM, a WinRM shell with a focus on enumeration and exploitation.