# Evil Winrm

> Use for controlled WinRM access validation during authorized internal pentests. Trigger on approved administrative workflow review, WinRM boundary checks, and validating whether an authorized credential can reach a specific Windows host.

- Skill: `timsonner/evil-winrm` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/evil-winrm`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/evil-winrm/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/evil-winrm

---


# Evil-WinRM

## Purpose

Use this skill for tightly scoped WinRM access validation when the rules of engagement explicitly allow remote shell access checks.

## Phase Fit

- Primary: Validation and Controlled Impact Demonstration
- Secondary: Vulnerability Analysis, Retest and Closure

## Use When

- Need to confirm whether an approved credential can access a specific Windows host over WinRM.
- Need to validate administrative boundary assumptions.
- Need a repeatable retest after WinRM hardening.

## Avoid When

- Remote shell access is not explicitly approved.
- Target scope or credential handling rules are unclear.

## Inputs

- Approved Windows host
- Authorized credential or hash context
- Stop conditions and evidence limits

## Procedure

1. Start with the smallest host set possible.
2. Validate connectivity and access without changing system state.
3. Capture only the minimum evidence needed to prove the boundary failure.
4. Stop immediately if the activity exceeds the approved impact level.
5. Preserve the exact host and credential context for retest.

## Command Syntax

Replace sample targets with approved in-scope assets and authorized credentials.

```bash
# Connect with username and password
evil-winrm -i 10.10.10.100 -u auditor -p '<password>'

# Connect with NTLM hash (Pass-the-Hash)
evil-winrm -i 10.10.10.100 -u administrator -H <NTLM_hash>

# Connect using Kerberos ticket
evil-winrm -i dc01.contoso.com -r contoso.com

# Load PowerShell scripts from a local directory on connect
evil-winrm -i 10.10.10.100 -u auditor -p '<password>' -s /opt/scripts/

# Upload executable from local directory
evil-winrm -i 10.10.10.100 -u auditor -p '<password>' -e /opt/executables/

# Connect over HTTPS (WinRM over SSL)
evil-winrm -i 10.10.10.100 -u auditor -p '<password>' -S
```

## Evidence to Capture

- Whether WinRM access succeeded with the approved credential
- Exact host, protocol, and credential context
- Boundary conditions needed for reproduction

## Safety Boundaries

- Do not use interactive access for broad host exploration.
- Avoid unnecessary commands or state changes after access is confirmed.