Evil-WinRM is a remote shell for interacting with Windows systems via WinRM (Windows Remote Management) protocol during penetration testing and post-exploitation phases.
The tool addresses the need for an interactive shell on Windows systems where WinRM is enabled, typically port 5985. It communicates using PSRP (Powershell Remoting Protocol) to establish runspace pools and execute commands. The shell provides a user-friendly interface with features designed specifically for offensive security work, including in-memory script and assembly loading to bypass antivirus detection, pass-the-hash authentication, Kerberos support with ccache and kirbi file compatibility, ETW bypass capabilities, and dynamic AMSI bypass to evade signature-based detection.
The tool suits penetration testers and red teamers who have obtained valid credentials or NTLM hashes for Windows systems with WinRM enabled. It works on both Linux and Windows client systems and is available as a Docker image for quick deployment. System administrators may also use it for legitimate remote management purposes. The project includes practical features like file upload and download with progress indicators, command history, tab completion for local and remote paths, and optional logging. It supports SSL certificates and allows customization of the user-agent string to blend with legitimate Windows traffic.
The project maintains active development with regular updates addressing security evasion techniques and expanding authentication options. The codebase receives ongoing refinement to support emerging bypass methods and detection avoidance strategies. The tool is distributed through multiple installation channels including package managers and Docker registries, indicating sustained maintenance across deployment methods.
