Hackplayers/evil-winrm
Evil Winrm
Evil-WinRM is a penetration testing tool and interactive remote shell designed for managing and executing commands on remote Windows systems via the WinRM protocol. It functions as a security utility for auditing Windows environments through remote command execution and credential manipulation.
The tool distinguishes itself through its authentication capabilities, acting as both a Kerberos authentication client using ticket-based files and an NTLM pass-the-hash client that accesses services using password hashes instead of plaintext credentials. To evade detection, it supports in-memory payload execution, allowing scripts and libraries to run directly in system memory without writing files to disk.
The project provides broader capabilities for lateral movement and security assessment, including the ability to bypass security defenses, enumerate remote services, and transfer files between local and remote hosts. It also includes session management features such as local activity logging and command history tracking.
Features
- Penetration Testing Tools - Provides a specialized security utility for auditing Windows environments through remote command execution and credential manipulation.
- Interactive Remote Shells - Establishes an interactive remote shell over WinRM to execute commands on target Windows systems.
- Windows Remote Management Tools - Provides a specialized tool for managing and executing commands on remote Windows systems via the WinRM protocol.
- In-Memory Payload Execution - Implements techniques to execute PowerShell scripts directly in volatile memory to evade disk-based security detection.
- Kerberos Authentication - Implements Kerberos authentication to verify identity to network services using ticket-based files.
- Ticket-Based Authenticators - Supports authentication using Kerberos ticket-granting files and realm configurations to access remote resources without passwords.
- Pass-the-Hash Clients - Enables access to remote systems by providing captured NTLM password hashes directly to the service.
- Interactive Remote Shells - Provides a bidirectional terminal session for real-time interaction and command execution on remote Windows systems.
- Penetration Testing - Provides a toolset for performing security assessments on Windows targets via remote command execution.
- Service Enumeration Tools - Lists available services on a target machine to identify manageable resources based on user permissions.
- Security Software Evasion - Disables script protection and event tracing to evade detection by security software.
- Lateral Movement Techniques - Facilitates movement through target environments using NTLM hashes and Kerberos tickets.
- Remote File Transfers - Provides bidirectional file transfers between local and remote systems with progress monitoring.
- Exploitation Tools - Shell for interacting with Windows systems via WinRM.
- Lateral Movement - Provides shell access via WinRM.
- Windows Post Exploitation - Command line interface for remote management and command execution on Windows.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
