How do I install the Evil Winrm skill?

Run npx skillmds@latest add timsonner/evil-winrm in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Evil Winrm safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Evil Winrm?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Evil Winrm free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Evil Winrm?

timsonner (@timsonner) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Evil Winrm by timsonner — Agent Skill

Name: Evil Winrm
Author: timsonner

Evil Winrm

Use for controlled WinRM access validation during authorized internal pentests. Trigger on approved administrative workflow review, WinRM boundary checks, and validating whether an authorized credential can reach a specific Windows host.

timsonner bf30cf6 2.4 KB Updated Sep 17, 2026

File contents

Evil-WinRM

Purpose

Use this skill for tightly scoped WinRM access validation when the rules of engagement explicitly allow remote shell access checks.

Phase Fit

Primary: Validation and Controlled Impact Demonstration
Secondary: Vulnerability Analysis, Retest and Closure

Use When

Need to confirm whether an approved credential can access a specific Windows host over WinRM.
Need to validate administrative boundary assumptions.
Need a repeatable retest after WinRM hardening.

Avoid When

Remote shell access is not explicitly approved.
Target scope or credential handling rules are unclear.

Inputs

Approved Windows host
Authorized credential or hash context
Stop conditions and evidence limits

Procedure

Start with the smallest host set possible.
Validate connectivity and access without changing system state.
Capture only the minimum evidence needed to prove the boundary failure.
Stop immediately if the activity exceeds the approved impact level.
Preserve the exact host and credential context for retest.

Command Syntax

Replace sample targets with approved in-scope assets and authorized credentials.

# Connect with username and password
evil-winrm -i 10.10.10.100 -u auditor -p '<password>'

# Connect with NTLM hash (Pass-the-Hash)
evil-winrm -i 10.10.10.100 -u administrator -H <NTLM_hash>

# Connect using Kerberos ticket
evil-winrm -i dc01.contoso.com -r contoso.com

# Load PowerShell scripts from a local directory on connect
evil-winrm -i 10.10.10.100 -u auditor -p '<password>' -s /opt/scripts/

# Upload executable from local directory
evil-winrm -i 10.10.10.100 -u auditor -p '<password>' -e /opt/executables/

# Connect over HTTPS (WinRM over SSL)
evil-winrm -i 10.10.10.100 -u auditor -p '<password>' -S

Evidence to Capture

Whether WinRM access succeeded with the approved credential
Exact host, protocol, and credential context
Boundary conditions needed for reproduction

Safety Boundaries

Do not use interactive access for broad host exploration.
Avoid unnecessary commands or state changes after access is confirmed.

---name: evil-winrmdescription: Use for controlled WinRM access validation during authorized internal pentests. Trigger on approved administrative workflow review, WinRM boundary checks, and validating whether an authorized credential can reach a specific Windows host.license: MIT---# Evil-WinRM## PurposeUse this skill for tightly scoped WinRM access validation when the rules of engagement explicitly allow remote shell access checks.## Phase Fit- Primary: Validation and Controlled Impact Demonstration- Secondary: Vulnerability Analysis, Retest and Closure## Use When- Need to confirm whether an approved credential can access a specific Windows host over WinRM.- Need to validate administrative boundary assumptions.- Need a repeatable retest after WinRM hardening.## Avoid When- Remote shell access is not explicitly approved.- Target scope or credential handling rules are unclear.## Inputs- Approved Windows host- Authorized credential or hash context- Stop conditions and evidence limits## Procedure1. Start with the smallest host set possible.2. Validate connectivity and access without changing system state.3. Capture only the minimum evidence needed to prove the boundary failure.4. Stop immediately if the activity exceeds the approved impact level.5. Preserve the exact host and credential context for retest.## Command SyntaxReplace sample targets with approved in-scope assets and authorized credentials.```bash# Connect with username and passwordevil-winrm -i 10.10.10.100 -u auditor -p '<password>'# Connect with NTLM hash (Pass-the-Hash)evil-winrm -i 10.10.10.100 -u administrator -H <NTLM_hash># Connect using Kerberos ticketevil-winrm -i dc01.contoso.com -r contoso.com# Load PowerShell scripts from a local directory on connectevil-winrm -i 10.10.10.100 -u auditor -p '<password>' -s /opt/scripts/# Upload executable from local directoryevil-winrm -i 10.10.10.100 -u auditor -p '<password>' -e /opt/executables/# Connect over HTTPS (WinRM over SSL)evil-winrm -i 10.10.10.100 -u auditor -p '<password>' -S```## Evidence to Capture- Whether WinRM access succeeded with the approved credential- Exact host, protocol, and credential context- Boundary conditions needed for reproduction## Safety Boundaries- Do not use interactive access for broad host exploration.- Avoid unnecessary commands or state changes after access is confirmed.

Frequently asked questions