> For the complete documentation index, see [llms.txt](https://kwcsec.gitbook.io/the-red-team-handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kwcsec.gitbook.io/the-red-team-handbook/techniques/lateral-movement/winrm.md).

# WinRM

WinRM is a Microsoft implementation of the WS-Management Protocol. It uses WMI over HTTP(S) over 5985/TCP and 5986/TCP.

WinRM requires listeners on the client and server to process requests. This can be enabled using the Powershell command ’`Enable-PSRemoting –Force`’ locally and remotely using any of the previous techniques.

```
winrs -r:REMOTEIP -u:DOMAIN\USER -p:PASSWORD notepad.exe
```

We can also avoid the double-hop problem with -EnableNetworkAccess

```
PS> Enter-PSSession –ComputerName REMOTEIP –Credential DOMAIN\USER –EnableNetworkAccess
```

If the computer is not domain joined, then you need to add the target computer to the trustedhosts list

```
PS > winrm quickconfig
PS > Set-Item WSMan:\localhost\Client\TrustedHosts –Value ’<TARGET_HOST>,<TARGET_HOST2>’
```