> For the complete documentation index, see [llms.txt](https://ivalexev.gitbook.io/rednote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ivalexev.gitbook.io/rednote/utility/service/winrm-5985-5986.md).

# WinRM (5985-5986)

Windows Remote Management.

<details>

<summary>Protocol Information</summary>

Allows systems to access or exchange management information through HTTP(S). Created to facilitate operations for system administrators. Thus it was used to remotely access and interact with windows hosts on a local network, execute commands on those hosts, and remotely configure and administer windows systems. WinRM implements access control and communication security through various forms of authentication.

</details>

## Port

<table data-header-hidden><thead><tr><th width="166">Port</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:green;"><strong>5985</strong></mark><strong> TCP</strong></td><td>WinRM HTTP</td></tr><tr><td><mark style="color:green;"><strong>5986</strong></mark><strong> TCP</strong></td><td>WinRm HTTPS</td></tr></tbody></table>

## Interact

{% tabs %}
{% tab title="Linux" %}

<table><thead><tr><th width="142">Tools</th><th>Details</th></tr></thead><tbody><tr><td><a href="https://github.com/Hackplayers/evil-winrm">evil-winrm</a></td><td><code>evil-winrm.rb -u &#x3C;USER>[@&#x3C;DOMAIN>] -p &#x3C;PASS> -i &#x3C;IP></code></td></tr><tr><td><a href="https://github.com/ozelis/winrmexec">winrmexec</a></td><td><code>python3 evil_winrmexec.py -ssl -port 5986 &#x3C;DOMAIN>/&#x3C;USER>:'&#x3C;PASS>'@&#x3C;IP/HOST> [-k]</code></td></tr></tbody></table>
{% endtab %}

{% tab title="Windows" %}
{% code overflow="wrap" %}

```powershell
$password = ConvertTo-SecureString "<PASS>" -AsPlainText -Force
$cred = new-object System.Management.Automation.PSCredential ("<DOMAIN>\<USER>", $password)
Enter-PSSession -ComputerName <PC_NAME> -Credential $cred
```

{% endcode %}
{% endtab %}
{% endtabs %}