Authentication

WinRM Authentication

Testing credentials

nxc winrm <target> -u <username> -p <password>

Expected Results:

WINRM       <target> 5985   ROGER            [*] http://<target>:5985/wsman
WINRM       <target> 5985   ROGER            [+] <domain>\<username>:<password> (Pwn3d!)

If the SMB port is closed you can also use the flag -d DOMAIN to avoid an SMB connection

nxc winrm <target> -u <username> -p <password> -d <domain>

Expected Results:

WINRM       <target> 5985   <target>  [*] http://<target>:5985/wsman
WINRM       <target> 5985   <target>  [+] <domain>\<username>:<password> (Pwn3d!)

Example

Monteverde machine is a good example to test WinRM procotol with NetExec

{% embed url="https://www.hackthebox.com/machines/monteverde" %}