WinRM Penetration Testing

“WinRM implements the WS-Management Protocol and forms a key part of the Windows Management Framework. Once an attacker compromises credentials, WinRM is the premier avenue for stealthy, native lateral movement across the domain.”

For years lateral movement meant SMB or a hijacked RDP session, and both light up a modern SOC—PsExec service creation and interactive logons are exactly what detection rules are tuned for. Windows Remote Management (WinRM) is the quieter option: it rides HTTP/HTTPS on ports 5985/5986 and runs PowerShell, so an attacker’s traffic looks like an admin doing their job, because it uses the same channel the admin does. WinRM Penetration Testing lays out the full architecture of abusing it.

Infrastructure and Configuration

The guide makes you stand the service up before you attack it—Enable-PSRemoting -Force, then adjusting trustedhosts. Configuring it by hand is what makes the common misconfiguration obvious: the admin who sets trustedhosts to a wildcard (*) to stop the connection errors, and in doing so tells every host on the network to trust every other one.

Lateral Movement Protocols

With the service running, the guide turns to exploitation and shows several ways to push a shell onto a second machine:

• Native Windows Tools: No malware at all—Enter-PSSession and winrs open admin shells straight from a compromised Windows 10 client into a Server 2019 box. This is the living-off-the-land path, and the hardest for defenders to separate from legitimate work.
• NetExec (nxc): The modern workhorse for spraying captured credentials against port 5985 across whole subnets to find where they still work.
• Metasploit & Docker Execution: The module configuration to hit port 5985 from an external Linux attacker box, turning a weak credential into a persistent Meterpreter session—faster to run, and considerably louder than the native route.

Who Is This Book REALLY For?

• Red Team Operators: WinRM is the go-to for living-off-the-land lateral movement, and the guide has the exact syntax for running PowerShell against remote hosts natively.
• Threat Hunters & Blue Teams: The concrete artefacts winrs and Enter-PSSession leave behind—the material you need to write SIEM alerts for unusual 5985/5986 traffic instead of guessing.
• Active Directory Architects: The argument for tier-based trustedhosts restrictions, and what enabling WinRM everywhere without them actually opens up.

The Bottom Line

WinRM Penetration Testing makes the uncomfortable point plainly: horizontal movement rarely needs a zero-day. It needs a valid credential and the administrative protocol built to manage the estate—the same protocol the defenders rely on, which is precisely what makes it hard to shut off.