6.4.2 Check whether your identity can open a remote session Access using WinRM or RDP
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
A compatible credential, reachable target listener and the service-specific endpoint/logon right. Windows-domain naming and Kerberos requirements still apply.
Where to look: For WinRM inspect endpoint availability and authorization; for RDP inspect remote-interactive logon rights, group/policy, NLA and credential-mode support. Use the complete RDP procedure for FreeRDP variants.
Expected behavior / secure boundary: A WinRM or RDP listener is not a grant of access. Non-admin remote-management access can be intentionally delegated. A remote WinRM session may lack a usable onward credential context even when the first hop succeeds.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.4.2.1 WinRM credential and transport variants
Run: Kali / Linux with Evil-WinRM. Requires: Compatible material, reachable WinRM listener and endpoint authorization. Effect: Creates a remote command session; target commands can change state.
6.4.2.1.1 Authenticate with a known password using a supported prompt Password; omit -p to prompt where supported
# Password; omit -p to prompt where supported
evil-winrm -i TARGET_HOST -u USER -p 'PASSWORD'
6.4.2.1.2 Use or recover a password from an identified NT hash NT hash
# NT hash
evil-winrm -i TARGET_HOST -u USER -H NT_HASH
6.4.2.1.3 Connect to the verified remote-management HTTPS listener HTTPS listener
# HTTPS listener
evil-winrm -i TARGET_HOST -u USER -p 'PASSWORD' -S -P 5986
6.4.2.2 WinRM using native WinRS
Run: Windows with WinRS. Requires: Reachable authorized WinRM endpoint and selected network credentials. Effect: Executes the selected remote identity/host verification command.
winrs /r:TARGET_HOST /u:DOMAIN\USER /p:PASSWORD "cmd /c hostname & whoami"
What this checks: Evil-WinRM and WinRS are different clients to WinRM. Their credential modes and platform requirements differ. A password/hash example must match the material; the full procedure also documents ticket and HTTPS variants.
6.4.2.3 Interpret the output
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
WinRM: authentication succeeds
Command: whoami -> EXAMPLE\analyst
Onward access to \\FS01\Finance: access denied
RDP: requested logon type not granted
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| whoami on target | The session executed as the displayed identity. | Verify host/token and re-enumerate from that state. | §6.5.2.1 — Re-enumerate after an identity or host change |
| Onward share denied | Could be second-hop credential context or share authorization. | Inspect the network identity and service rights; do not invalidate the first hop. | §6.5.1.1 — Diagnose the failed boundary |
| RDP logon type denied | A service-specific policy boundary. | Check remote-interactive rights/deny policies or choose another authorized service. | §6.4.1.1 — Select a compatible remote-access mechanism |
Stop when: First-hop identity/host and the tested endpoint result are verified.
Revisit only when: Endpoint policy, logon rights or onward network credential context changes.
6.4.2.4 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | A session is established: verify host, token and network identity, then re-enumerate. | §6.5.2.1 — Re-enumerate after an identity or host change |
| Ruled out in this context | An endpoint explicitly denies the needed logon: rule out that service/context until new evidence. | §6.4.1.1 — Select a compatible remote-access mechanism |
| Inconclusive / failed check | TLS/NLA/listener errors: diagnose the protocol layer before changing credentials. | §6.5.1.1 — Diagnose the failed boundary |
6.4.2.5 Tooling and complete procedure
Evil-WinRM on Kali; WinRS/PowerShell remoting on Windows; FreeRDP for RDP. The detailed page retains credential-mode and version-specific variants. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.