# T1021.006 - Remote Services: Windows Remote Management

## Description from ATT&CK

> Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.
> 
> WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014) WinRM  can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).(Citation: MSDN WMI)

[Source](https://attack.mitre.org/techniques/T1021/006)

## Atomic Tests

- [Atomic Test #1: Enable Windows Remote Management](#atomic-test-1-enable-windows-remote-management)
- [Atomic Test #2: Remote Code Execution with PS Credentials Using Invoke-Command](#atomic-test-2-remote-code-execution-with-ps-credentials-using-invoke-command)
- [Atomic Test #3: WinRM Access with Evil-WinRM](#atomic-test-3-winrm-access-with-evil-winrm)

### Atomic Test #1: Enable Windows Remote Management

Powershell Enable WinRM

Upon successful execution, powershell will "Enable-PSRemoting" allowing for remote PS access.

**Supported Platforms:** Windows

**auto_generated_guid:** `9059e8de-3d7d-4954-a[PII_REDACTED]0b9cf`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
Enable-PSRemoting -Force
```

### Atomic Test #2: Remote Code Execution with PS Credentials Using Invoke-Command

Simulate lateral movement with PowerShell Remoting on the local host. 
Upon successful execution, PowerShell will execute `whoami` using `Invoke-Command`, targeting the 
local machine as remote target.

**Supported Platforms:** Windows

**auto_generated_guid:** `5295bd61-bd7e-4744-9d52-85962a4cf2d6`

#### Attack Commands: Run with `powershell`!

```powershell
Enable-PSRemoting -Force
Invoke-Command -ComputerName $env:COMPUTERNAME -ScriptBlock {whoami}
```

#### Cleanup Commands

```powershell
Disable-PSRemoting -Force
```
### Atomic Test #3: WinRM Access with Evil-WinRM

An adversary may attempt to use Evil-WinRM with a valid account to interact with remote systems that have WinRM enabled

**Supported Platforms:** Windows

**auto_generated_guid:** `efe86d95-44c4-4509-ae42-7bfd9d1f5b3d`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| user_name | Username | string | Domain&#92;Administrator|
| destination_address | Remote Host IP or Hostname | string | Target|
| password | Password | string | P@ssw0rd1|

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
evil-winrm -i #{destination_address} -u #{user_name} -p #{password}
```


#### Dependencies: Run with `powershell`!

##### Description: Computer must have Ruby Installed

###### Check Prereq Commands

```powershell
try {if (ruby -v) {exit 0} else {exit 1}} catch {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest  -OutFile "PathToAtomicsFolder\..\ExternalPayloads\rubyinstaller-2.7.1-1-x64.exe" https://github.com/oneclick/rubyinstaller2/releases/download/RubyInstaller-2.7.1-1/rubyinstaller-2.7.1-1-x64.exe
$file1= "PathToAtomicsFolder\..\ExternalPayloads\rubyinstaller-2.7.1-1-x64.exe"
Start-Process $file1 /S;
```

##### Description: Computer must have Evil-WinRM installed

###### Check Prereq Commands

```powershell
try {if (evil-winrm -h) {exit 0} else {exit 1}} catch {exit 1}
```

###### Get Prereq Commands

```powershell
gem install evil-winrm
```