WinRM scanning and brute forcing
Windows Remote Management (WinRM) is the Microsoft implementation of the WS-Management Protocol, a standard Simple Object Access Protocol (SOAP)-based, firewall-friendly protocol that allows hardware and operating systems, from different vendors, to interoperate.
Getting ready
The WinRM Authentication Method Detection auxiliary module sends a request to an HTTP/HTTPS service to see if it is a WinRM service. If it is a WinRM service, it also gathers the authentication methods supported.
Now that we know that the target system has WinRM enabled, we can start scanning to see if we can leverage WinRM and compromise the system.
Using the credentials found with the SMB Login Check Scanner auxiliary module, we can test if we can run Windows commands using the WinRM service, using the WinRM Command Runner auxiliary module.
How to do it...
- To use the WinRM Authentication Method Detection auxiliary module, set the target address range in
RHOSTSand typerun:
msf > use...
