Evil-Winrm - The Ultimate WinRM For Hacking/Pentesting

Deskripsi Dan Tujuan

Shell ini adalah the Ultimate WinRM Shel untuk hacking/Pentesting.
WinRM( Windows Remote Management ) adalah implementasi Microsoft dari WS-Management Protocol. Protokol standar Berbasis SOAP yang memungkinkan perangkat keras dan sistem operasi dari vendor yang berbeda untuk beroperasi. Microsoft memasukannya ke dalam sistem pengoperasian mereka untuk memudahkan sistem administrator

Program ini bisa digunakan di semua windows server dengan fitur ini diaktifkan ( biasanya pada port 5985 ), tentu saja jika kamu mempunyai credentials dan perijinan untuk menggunakan ini. jadi kita akan mengatakan boleh digunakan untuk hacking/ pentesting

Features

Command History
WinRM Command Completion
Local FIles Completion
Upload And Download files
List remote machine services
FullLanguage Powershell language mode
Load Powershell scripts
Load in memory dll files bypassing some AV
Load in memory C# ( C Sharp ) compiled exe files bypassing some AVs
Colorization on output messages ( Can be disabled optionally )

Help

Requirements

dibutuhkan Ruby 2.3 atau lebih tinggi. beberapa Ruby gems juga dibutuhkan: winrm >= 2.3.2, winrm-fs
>=1.3.2, stringio >=0.0.2 dan colorize >= 0.8.1

$ sudo gem install winrm winrm-fs colorize stringio

Installation & Quick Start

$ git clone https://github.com/Hackplayers/evil-winrm.git
$ cd evil-winrm && ruby evil-winrm.rb -i 192.168.1.100 -u Administrator -p 'MySuperSecr3tPass123!' -s 'home/foo/s1_scripts/' -e '/home/foo/exe_files/'

Jika kamu tidak mau menaruh password di text kosong, kamu bisa tidak menetapkan argumen -p dan kata sandi akan diminta untuk mencegah ditampilkan

untuk menggunakan IPv6, adress harus di tambahkan dulu di /etc/hosts

Alternative installation method as ruby gem

$ gem install evil-winrm
$ evil-winrm -i 192.168.1.100 -u Administrator -p 'MySuperSecr3tPass123!' -s '/home/foo/ps1_scripts/' -e '/home/foo/exe_files/'

Basic Commands

Upload: local files can be auto-completed using tab key. it is not needed to put a remote_path if the local file is in the same directory as evil-winrm.rb file

usage :

upload local_path remote_path

download: it is not needed to set local_path if the remote file is in the current directory.

usage :

download remote_path local_path

services: list all services. No administrator permission needed

menu: load the Invoke-Binary and l04d3r-LoadDll function that we will explain below. When a ps1 is loaded all its function will be shown up.

 Load powershell scripts

To load a ps1 file you just have to type the name (auto-completion using tab allowed). The scripts must be in the path set at -s argument. Type menu again and see the loaded function 

 

Advanced Commands

Invoke-Binary: allows exes compiled from c# to be executed in memory. The name can be auto-completed using tab key and allows up to 3 parameters. The executables must be in the path set at -e argument

 l04d3r-LoadDll: allows loading dll libraries in memory, it is equivalent to:

[Reflection.Assembly]::Load([IO.File]::ReadAllBytes("pwn.dll"))




The dll file can be hosted by smb, http or locally. Once it is loaded type menu, then it is possible to autocomplete all functions

Extra Features

to disable colors just modify in code this variable $colors_enabled. Set it to false: $colors_enabled = false