Evil-WinRM
WinRM shell for Windows post-exploitation.
KaliParrothigh
pkg: evil-winrm
Evil-WinRM gives a feature-rich WinRM shell (uploads, scripts, pass-the-hash) once you have valid Windows creds.
Syntax
evil-winrm -i {host} -u {user} -p {pass}
Example
evil-winrm -i 10.0.0.5 -u admin -H {hash}
Opens a WinRM shell using a password or NTLM hash (pass-the-hash).
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
evil-winrm
Usage examples
evil-winrm -i 10.0.0.5 -u admin -p Password1
WinRM shell with a password.
evil-winrm -i 10.0.0.5 -u admin -H aad3b...
Pass-the-hash login.
Advantages
- Stable Windows shell
- PtH + upload/scripts
Disadvantages
- Needs WinRM + creds
- Logged
Tags
#windows#winrm#shell
Official docs: Evil-WinRM ↗
Related commands
Frequently asked questions
What is Evil-WinRM used for?
Evil-WinRM gives a feature-rich WinRM shell (uploads, scripts, pass-the-hash) once you have valid Windows creds.
What is an example Evil-WinRM command?
A common example is: evil-winrm -i 10.0.0.5 -u admin -H {hash} — Opens a WinRM shell using a password or NTLM hash (pass-the-hash).
Is Evil-WinRM part of Kali Linux?
Yes. Evil-WinRM ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install evil-winrm.
What category of security tool is Evil-WinRM?
Evil-WinRM is a Password Attacks tool with a high-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.