name: evil-winrm
category: ad
description: Windows Remote Management shell for penetration testing.
keywords:
  - winrm
  - windows
  - shell
  - remote
  - powershell
  - lateral

parameters:
  ip:
    type: string
    required: true
    flag: "-i"
    description: Target IP address

  user:
    type: string
    required: true
    flag: "-u"
    description: Username

  password:
    type: string
    flag: "-p"
    description: Password

  hash:
    type: string
    flag: "-H"
    description: NT hash for pass-the-hash

  port:
    type: integer
    flag: "-P"
    default: 5985
    description: WinRM port

  ssl:
    type: boolean
    flag: "-S"
    description: Use SSL (port 5986)

  scripts:
    type: string
    flag: "-s"
    description: PowerShell scripts path

  executables:
    type: string
    flag: "-e"
    description: Executables path

  no_colors:
    type: boolean
    flag: "-N"
    description: Disable colors

  log:
    type: boolean
    flag: "-l"
    description: Enable logging

requires_root: false
timeout: 0
interactive: true

examples:
  - "evil-winrm -i 192.168.1.1 -u administrator -p 'Password123'"
  - "evil-winrm -i 192.168.1.1 -u administrator -H aad3b435b51404eeaad3b435b51404ee"
  - "evil-winrm -i 192.168.1.1 -u user -p pass -s /opt/scripts -e /opt/exe"
  - "evil-winrm -i 192.168.1.1 -u user -p pass -S"

notes: |
  Built-in commands:
  - upload: Upload file
  - download: Download file
  - menu: Show functions
  - services: List services
  - Bypass-4MSI: AMSI bypass
  - Dll-Loader: Load DLL
  - Invoke-Binary: Run .NET binary

  With scripts (-s):
  - Load PowerShell scripts
  - Run with: Invoke-Script.ps1

  With executables (-e):
  - Upload and run .exe files
  - Useful for C# tools

  Requirements:
  - Port 5985 (HTTP) or 5986 (HTTPS)
  - Valid credentials or hash
  - User in Remote Management Users

  Tips:
  - Use pass-the-hash with -H
  - Pre-stage scripts and tools
  - Use Bypass-4MSI for AV evasion