Command execution

Execute Command using WinRM

nxc winrm <target> -u <username> -p <password> -X whoami
WINRM       <target> 5985   ROGER            [*] http://<target>:5985/wsman
WINRM       <target> 5985   ROGER            [+] <domain>\<username>:<password> (Pwn3d!)
WINRM       <target> 5985   ROGER            [+] Executed command
WINRM       <target> 5985   ROGER            <domain>\<username>

What next ?

Evil-winrm tool to pwn everything !

{% embed url="https://github.com/Hackplayers/evil-winrm" %}