nimrm

nimrm Native WinRM shell client written in Nim Version 1.2.0 · Author Chokri Hammedi blue0x1 · License MIT Legal Notice nimrm is intended for lawful administration, security testing, and research on systems you own or have explicit permission to access. The author is not responsible for misuse or...

CVE-2025-33073

CVE-2025-33073 Reflection Relay PoC Universal exploitation tool for CVE-2025-33073 targeting Windows Domain Controllers with DNSAdmins privileges and WinRM enabled. 📋 Overview CVE-2025-33073 is a critical vulnerability that allows attackers to achieve SYSTEM-level code execution on Windows Domain...

RemotePSpy

RemotePSpy RemotePSpy provides live monitoring of remote PowerShell sessions, which is particularly useful for older pre-5.0 versions of PowerShell which do not have comprehensive logging facilities built in. It uses Event Tracing for Windows ETW to obtain message data from the WinRM protocol tha...

RogueWinRM

RogueWinRM RogueWinRM is a local privilege escalation exploit that allows to escalate from a Service account with SeImpersonatePrivilege to Local System account if WinRM service is not running default on Win10 but NOT on Windows Server 2019. Briefly, it will listen for incoming connection on port...

ZeroLogon-to-Shell

This is a combination of the zerologontester.py code and the tool evil-winrm to get a shell. I just added a "os.system" to use evil-winrm. Requirements: To get the Administrator NTLM HASH I recommend you to use secretsdump tool from impacket And, of course, you need to install evil-winrm This is...

CVE-2021-31166

CVE-2021-31166 Description - POC for CVE-2021-31166: Windows HTTP协议栈远程代码执行漏洞 - create by antx at 2021-09-27. Detail - ./trigger.gifPoc-Gif CVE Severity - attackComplexity: LOW - attackVector: NETWORK - availabilityImpact: HIGH - confidentialityImpact: HIGH - integrityImpact: HIGH -...

LACheck

LACheck Multithreaded C .NET Assembly Local Administrative Privilege Enumeration Arguments ./LACheck.exe help | | /\ / | | | | | | / \ | | | | | | | | / /\ \ | | | ' \ / / | |/ / | | / \ | || | | | / | |// \ || |||||\ Usage: LACheck.exe smb rpc /targets:hostname,fqdn.domain.tld,10.10.10.10...

evil-winrm

Evil-WinRM !Version-shield !Ruby2.3-shield !Gem-Version !License-shield !Docker-shield The ultimate WinRM shell for hacking/pentesting Description & Purpose This shell is the ultimate WinRM shell for hacking/pentesting. WinRM Windows Remote Management is the Microsoft implementation of...

WSMan-WinRM

WSMan-WinRM A collection of proof-of-concept source code and scripts for executing remote commands over WinRM using the WSMan.Automation COM object. Background For background information, please refer to the following blog post: WS-Management COM: Another Approach for WinRM Lateral Movement Notes...

evil-winrm-py

evil-winrm-py evil-winrm-py is a python-based tool for executing commands on remote Windows machines using the WinRM Windows Remote Management protocol. It provides an interactive shell with enhanced features like file upload/download with progress and checksum verification, tab-completion of...

EntraPassTheCert

EntraPassTheCert EntraPassTheCert is a post-exploitation tool that allows attackers to request Entra ID's user P2P certificate and authenticate to a remote Entra joinned machine with it. $ python3 entraptc.py -h usage: entraptc.py -h --debug requestp2pcert,smb,rdp,winrm,rpc ... post-exploitation...

nosferatu

nosferatu Windows NTLM/Kerberos Authentication Backdoor How it Works First, the DLL is injected into the lsass.exe process, and will begin hooking authentication WinAPI calls. The targeted functions are: NTLM: NtlmShared!MsvpPasswordValidate Kerberos: cryptdll!CDLocateCSystem Kerberos:...

PeekABoo

PeekABoo PeekABoo tool can be used during internal penetration testing when a user needs to enable Remote Desktop on the targeted machine. It uses PowerShell remoting to perform this task. The tool only works if WinRM is enabled. Since Windows Server 2012 WinRM is enabled by default on all Window...

PS-CVE-2021-21551

Description Script to patch your domain computers about the CVE-2021-21551. Privesc on machines that have the driver dbutil23.sys, installed by some DELL tools BIOS updater, SupportAssist.... It uses WinRM to invoke the checks on every domain-member computers. Tries to clean the vulnerable driver...

Kitsune

Kitsune Kitsune is a Polymorphic Command & Control. This tool allows you to get a graphical version of your favourite hacking tools, such as NetExec, Villain or Evil-WinRM among others. In addition, brings many improvements such as automatic reconnection, reports, history and some extra functions...

doublehop

Doublehop This tool aims to assist in using PowerShell Remoting / WinRM to execute PowerShell commands on remote hosts through WinRM double hop technique. This tool assumes you have internal network and CLI access. Usage doublehop Usage: -c string Command we are executing. -j string Host we are...

CVE-2020-1472

CVE-2020-1472 CVE 2020-1472 検証スクリプト 前提条件: ドメインコントローラー間でWinRMが有効になっていること。 必要な権限: - 子ドメインが存在する場合: エンタープライズ管理者 - 単一フォレスト、単一ドメインの場合: ドメイン管理者...

CVE-2024-30088__Windows-TOCTOU-exploit

CVE-2024-30088 – WinRM Adapted PoC 📌 Summary This is a modified version of the original CVE-2024-30088 exploit, adapted to work in non-interactive environments WinRM. The original PoC spawns an interactive cmd.exe, which does not work over WinRM. This version focuses on non-interactive execution...

CVE-2021-31166-detection-rules

CVE-2021-31166 Detection Rules Different rules to detect if CVE-2021-31166 is being exploited Rules available: Suricata Snort The snort rules also work on suricata. Zeek To Do: Make PCAPs available which where used during the development of the signatures Zeek script Detection when the...

evil-winrm v4.1

Evil-WinRM !Version-shield !Ruby2.3-shield !Gem-Version !License-shield !Docker-shield The ultimate WinRM shell for hacking/pentesting Description & Purpose This shell is the ultimate WinRM shell for hacking/pentesting. WinRM Windows Remote Management is the Microsoft implementation of...