PE-EVI
evil-winrm
Ruby-based WinRM client for opening an authenticated remote PowerShell session on a Windows host.
OVERVIEW
evil-winrm is a Ruby client for Windows Remote Management (WinRM), the WS-Management protocol Windows exposes on TCP 5985/5986 for remote administration. Given a set of valid credentials — a password, an NTLM hash for pass-the-hash, or a Kerberos ticket — it opens an interactive PowerShell session on the target without needing to drop a separate C2 implant.
Beyond the base shell it bundles quality-of-life features aimed at engagements: upload/download over the same channel, in-memory loading of PowerShell scripts and .NET assemblies (including common offensive libraries), command history, and tab completion, all from a single gem install on the operator side.
USE CASES
Practical use cases
- 01
Turning a set of confirmed credentials into an interactive PowerShell session without an implant.
- 02
Authenticating with an NTLM hash (pass-the-hash) when only a hash, not a password, was recovered.
- 03
Uploading tooling and loading offensive PowerShell/.NET modules directly into the session memory.
- 04
Validating that a low-privilege or service account actually has WinRM access as part of a lateral-movement path.
QUICK START
With valid local or domain credentials (or an NTLM hash) already in hand and WinRM reachable, to get an interactive PowerShell session instead of dropping a separate implant.
- Confirm the credentials or hash in hand are in scope for remote-access testing.
- Install the gem (gem install evil-winrm) on the operator machine.
- Confirm WinRM is reachable on the target (TCP 5985/5986).
- Connect with the target IP and the credentials or hash, then verify the session with whoami.
- Use the built-in upload/download and script-loading commands as needed, documenting each action taken.
evil-winrm -i 10.10.10.10 -u administrator -p Passw0rd!BEFORE YOU RUN IT
What to check before running it
evil-winrm requires valid credentials and WinRM already enabled on the target — it's a remote-access shell, not a privilege-escalation or credential-theft primitive by itself.
Successful WinRM connections and executed commands are logged (PowerShell operational/transcription logs, Windows event log 4624), so treat the session as visible to a monitored environment.
Loading offensive PowerShell modules in memory can still trip AMSI or script-block logging depending on target hardening; confirm detection expectations with the client beforehand.