Authentication

WinRM Authentication
Testing credentials
1
#~ cme winrm 192.168.1.0/24 -u user -p password
Copied!
Expected Results:
1
WINRM       192.168.255.131 5985   ROGER            [*] http://192.168.255.131:5985/wsman
2
WINRM       192.168.255.131 5985   ROGER            [+] GOLD\user:password (Pwn3d!)
Copied!
If the SMB port is closed you can also use the flag -d DOMAIN to avoid an SMB connection
1
#~ cme winrm 192.168.1.0/24 -u user -p password -d DOMAIN
Copied!
Expected Results:
1
WINRM       192.168.255.131 5985   192.168.255.131  [*] http://192.168.255.131:5985/wsman
2
WINRM       192.168.255.131 5985   192.168.255.131  [+] GOLD\user:password (Pwn3d!)
Copied!
Example
Monteverde machine is a good example to test WinRM procotol with CrackMapExec
https://www.hackthebox.eu/home/machines/profile/223
www.hackthebox.eu
​

WINRM protocol - Previous

Password spraying

Next - WINRM protocol

Command execution

Last modified 4mo ago

Copy link

Contents

WinRM Authentication

Example