Evil-WinRM
WinRM shell for Linux and Windows that supports authorized remote management, file transfers, and PowerShell execution during security reviews.
Technical Architecture & Overview
Evil-WinRM is a Ruby-based WinRM client that provides an interactive shell for Windows remote management. It supports SSL, pass-the-hash, and Kerberos authentication, which makes it useful for testing and verifying WinRM exposure. Defenders can use it to confirm that WinRM access is limited to authorized principals and encrypted channels.
Targeted Technical Use Cases
Review of WinRM access controls and remote management posture on Windows servers during authorized assessments.
Evaluation & Trade-offs
Core Strengths
- +Supports pass-the-hash, Kerberos, and SSL authentication modes.
- +Offers file upload and download with PowerShell execution.
- +Works from Linux and Windows clients with a simple Ruby setup.
Trade-Offs & Limitations
- -Requires valid credentials or hashes to connect.
- -Targets only systems with WinRM enabled and reachable.
- -Does not bypass network segmentation or firewall rules.
Defensive Security Application
Identify overly permissive WinRM listeners and verify that authentication requires strong credentials and channel encryption.
Frequently Asked Questions
What is Evil-WinRM?→
Evil-WinRM is a Ruby-based WinRM client that provides an interactive shell for Windows remote management. It supports SSL, pass-the-hash, and Kerberos authentication, which makes it useful for testing and verifying WinRM exposure. Defenders can use it to confirm that WinRM access is limited to authorized principals and encrypted channels.
What is Evil-WinRM used for?→
Review of WinRM access controls and remote management posture on Windows servers during authorized assessments.
What are the strengths of Evil-WinRM?→
- +Supports pass-the-hash, Kerberos, and SSL authentication modes.
- +Offers file upload and download with PowerShell execution.
- +Works from Linux and Windows clients with a simple Ruby setup.
What are the limitations of Evil-WinRM?→
- +Requires valid credentials or hashes to connect.
- +Targets only systems with WinRM enabled and reachable.
- +Does not bypass network segmentation or firewall rules.
How is Evil-WinRM used defensively?→
Identify overly permissive WinRM listeners and verify that authentication requires strong credentials and channel encryption.