evil-winrm

Connect to target

$ evil-winrm -i [target_ip] -u [username] -p [password]

$ evil-winrm -i [target_ip] -u [username] -H [NTLM_hash]

$ evil-winrm -i [target_ip] -u [user] -p [pass] -S

$ upload [local_file] [remote_path]

$ download [remote_file] [local_path]

$ evil-winrm -i [ip] -u [user] -p [pass] -s [scripts/]

evil-winrm [options]

Evil-WinRM is a penetration testing shell for Windows Remote Management (WinRM). It provides an interactive PowerShell session with additional features for pentest activities.
The tool supports pass-the-hash authentication, file upload/download, and loading custom PowerShell scripts. It's designed for red team operations and authorized security testing.
Evil-WinRM provides better functionality than basic WinRM clients for security assessment workflows.

-i IP

Target IP address.

Username.

Password.

NTLM hash for pass-the-hash.

Use SSL.

PowerShell scripts directory.

Executables directory.

Custom port.

Display help information.

Only use with authorization. WinRM must be enabled on target. May trigger security alerts. AMSI bypass needed for some scripts.

Evil-WinRM was created by Hackplayers for the security research community, providing a feature-rich alternative to standard WinRM tools for penetration testing.

winrm(1), psexec(1), impacket(1)