Evil-WinRM

Evil-winrm is the ultimate WinRM shell designed for hacking and pentesting. It can be used on Microsoft Windows Servers with WinRM enabled (usually at port 5985), provided credentials and permissions are available. Primarily intended for post-exploitation phases, it offers user-friendly features focused on hacking and pentesting, though system administrators can use it for legitimate purposes.

WinRM (Windows Remote Management) is Microsoft's implementation of the WS-Management Protocol, a SOAP-based standard for interoperability between hardware and operating systems from different vendors. Evil-winrm leverages this to provide shell access and execute commands remotely.

The tool supports various authentication methods including password, hash, and Kerberos, making it versatile for different pentesting scenarios.

Evil-winrm uses PSRP (Powershell Remoting Protocol) for initializing runspace pools as well as creating and processing pipelines. It connects to WinRM services over HTTP/HTTPS (default port 5985) and provides an interactive shell for command execution on target Windows systems.