awesome-repositories.com
Blog
MCP
awesome-repositories.com

Discover the best open-source repositories with AI-powered search.

ExploreCurated searchesOpen-source alternativesSelf-hosted softwareBlogSitemap
ProjectMCP serverAboutHow we rankPress
LegalPrivacyTerms
© 2026 Bringes Technology SRL·VAT RO45896025·hello@awesome-repositories.com
Hackplayers avatar

Hackplayers/evil-winrm

0
View on GitHub↗

Evil Winrm

Evil-WinRM is a penetration testing tool and interactive remote shell designed for managing and executing commands on remote Windows systems via the WinRM protocol. It functions as a security utility for auditing Windows environments through remote command execution and credential manipulation.

The tool distinguishes itself through its authentication capabilities, acting as both a Kerberos authentication client using ticket-based files and an NTLM pass-the-hash client that accesses services using password hashes instead of plaintext credentials. To evade detection, it supports in-memory payload execution, allowing scripts and libraries to run directly in system memory without writing files to disk.

The project provides broader capabilities for lateral movement and security assessment, including the ability to bypass security defenses, enumerate remote services, and transfer files between local and remote hosts. It also includes session management features such as local activity logging and command history tracking.

AI search

Explore more awesome repositories

Describe what you need in plain English — the AI ranks thousands of curated open-source projects by relevance.

Start searching with AI

Features

  • Penetration Testing Tools - Provides a specialized security utility for auditing Windows environments through remote command execution and credential manipulation.
  • Interactive Remote Shells - Establishes an interactive remote shell over WinRM to execute commands on target Windows systems.
  • Windows Remote Management Tools - Provides a specialized tool for managing and executing commands on remote Windows systems via the WinRM protocol.
  • In-Memory Payload Execution - Implements techniques to execute PowerShell scripts directly in volatile memory to evade disk-based security detection.
  • Kerberos Authentication - Implements Kerberos authentication to verify identity to network services using ticket-based files.
  • Ticket-Based Authenticators - Supports authentication using Kerberos ticket-granting files and realm configurations to access remote resources without passwords.
  • Pass-the-Hash Clients - Enables access to remote systems by providing captured NTLM password hashes directly to the service.
  • Interactive Remote Shells - Provides a bidirectional terminal session for real-time interaction and command execution on remote Windows systems.
  • Penetration Testing - Provides a toolset for performing security assessments on Windows targets via remote command execution.
  • Service Enumeration Tools - Lists available services on a target machine to identify manageable resources based on user permissions.
  • Security Software Evasion - Disables script protection and event tracing to evade detection by security software.
  • Lateral Movement Techniques - Facilitates movement through target environments using NTLM hashes and Kerberos tickets.
  • Remote File Transfers - Provides bidirectional file transfers between local and remote systems with progress monitoring.
  • Exploitation Tools - Shell for interacting with Windows systems via WinRM.
  • Lateral Movement - Provides shell access via WinRM.
  • Windows Post Exploitation - Command line interface for remote management and command execution on Windows.
5,403 stars·679 forks·Ruby·LGPL-3.0·24 views

Star history

Star history chart for hackplayers/evil-winrmStar history chart for hackplayers/evil-winrm

How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.

Frequently asked questions

What does hackplayers/evil-winrm do?

Evil-WinRM is a penetration testing tool and interactive remote shell designed for managing and executing commands on remote Windows systems via the WinRM protocol. It functions as a security utility for auditing Windows environments through remote command execution and credential manipulation.

What are the main features of hackplayers/evil-winrm?

The main features of hackplayers/evil-winrm are: Penetration Testing Tools, Interactive Remote Shells, Windows Remote Management Tools, In-Memory Payload Execution, Kerberos Authentication, Ticket-Based Authenticators, Pass-the-Hash Clients, Penetration Testing.

Which projects share features with hackplayers/evil-winrm?

Projects with overlapping indexed features include: hackerschoice/thc-tips-tricks-hacks-cheat-sheet — This project is a comprehensive command-line reference and toolkit designed for Linux system administration and… samratashok/nishang — Nishang is a PowerShell-based offensive security framework designed for red teaming and penetration testing on Windows… thewover/donut — Donut is a toolset for loading and executing payloads in memory, featuring a position-independent shellcode generator,… mantvydasb/redteaming-tactics-and-techniques — This project is a red teaming knowledge base and offensive security playbook designed to simulate adversary behavior.… trickster0/offensiverust — OffensiveRust is a red team toolkit and malware development kit written in Rust. It serves as an evasion framework and… byt3bl33d3r/offensivenim — OffensiveNim is a red teaming framework and post-exploitation toolkit developed in Nim. It provides a collection of…

Projects sharing features with Evil Winrm

These projects share indexed features with Evil Winrm. Shared tags can include platform or build tooling; verify the primary use case before treating a result as a replacement.
  • hackerschoice/thc-tips-tricks-hacks-cheat-sheethackerschoice avatar

    hackerschoice/thc-tips-tricks-hacks-cheat-sheet

    3,853View on GitHub↗

    This project is a comprehensive command-line reference and toolkit designed for Linux system administration and network security assessment. It provides a collection of technical snippets and operational guides focused on managing remote environments, orchestrating shell sessions, and executing administrative tasks through native terminal utilities. The repository distinguishes itself by offering specialized techniques for stealthy operations and infrastructure manipulation. It covers methods for establishing encrypted tunnels to bypass firewalls, obfuscating process identities and command hi

    Shell
    View on GitHub↗3,853
  • samratashok/nishangsamratashok avatar

    samratashok/nishang

    9,951View on GitHub↗

    Nishang is a PowerShell-based offensive security framework designed for red teaming and penetration testing on Windows targets. It functions as a post-exploitation toolkit and payload generator to automate attacks and manage remote targets. The project provides specialized capabilities for bypassing security controls, such as disabling the Antimalware Scan Interface and employing in-memory execution to avoid disk-based detection. It includes a variety of stealthy command and control mechanisms, utilizing non-standard channels like DNS TXT records, ICMP traffic, and webmail for communication a

    PowerShellactivedirectoryhackinginfosec
    View on GitHub↗9,951
  • thewover/donutTheWover avatar

    TheWover/donut

    4,461View on GitHub↗

    Donut is a toolset for loading and executing payloads in memory, featuring a position-independent shellcode generator, an in-memory payload injector, and a .NET assembly loader. It is designed to convert executable files and scripts into shellcode that can be executed within the memory space of a remote process without writing files to disk. The project specializes in security evasion through memory-based patching and payload obfuscation using symmetric block ciphers and compression. It includes a remote payload stager to retrieve encrypted modules from HTTP or DNS servers during runtime, red

    C
    View on GitHub↗4,461
  • mantvydasb/redteaming-tactics-and-techniquesmantvydasb avatar

    mantvydasb/RedTeaming-Tactics-and-Techniques

    4,620View on GitHub↗

    This project is a red teaming knowledge base and offensive security playbook designed to simulate adversary behavior. It serves as a comprehensive collection of technical guides and tactics for executing red team operations. The repository provides detailed instructions for Active Directory exploitation, including Kerberos abuse and domain privilege escalation. It covers defense evasion through API unhooking and payload obfuscation, as well as Windows internals research involving the manipulation of kernel objects and system memory. The capability surface extends to network penetration testi

    PowerShelloffensive-securityoscppentesting
    View on GitHub↗4,620
Compare all 30 related projects→