Simple WinRM Shell | Evil WinRM

May 11, 2020 // echel0n

Here is a ruby snippet to get a shell through WinRM service with usage of known credentials.


  1. #!/usr/bin/env ruby
  2. require 'winrm'
  3. # Author: Alamot
  4. conn = WinRM::Connection.new(
  5. endpoint: 'http:/<REPLACE_ME>:5985/wsman',
  6. transport: :ssl,
  7. user: 'Administrator',
  8. password: '<REPLACEME>',
  9. :no_ssl_peer_verification => true
  10. )
  11. command=""
  12. conn.shell(:powershell) do |shell|
  13. until command == "exit\n" do
  14. output = shell.run("-join($id,'PS ',$(whoami),'@',$env:computername,' ',$((gi $pwd).Name),'> ')")
  15. print(output.output.chomp)
  16. command = gets
  17. output = shell.run(command) do |stdout, stderr|
  18. STDOUT.print stdout
  19. STDERR.print stderr
  20. end
  21. end
  22. puts "Exiting with code #{output.exitcode}"
  23. end