Evil-WinRM shell

please send me pm with hint to get root. i manage to get user.txt flag, thanks for above comments.

I think you were wrong about the forum. This is to talk about Evil-WinRM. By the way, thanks to all who use it and give us back your opinions.

Great tool

Thank you for this tool. I used it for one of the machines.

When I use control c out of a command on the remote machinethe whole shell dies. Not sure if this is something you can fix just like SSH? I think this would be quite helpful as well. If not, all good.

what causes error on upload feature? I got
Error: Upload failed. Check filenames or paths
Trying on local autocomplete path and full path from source file but still fail

Succeed on downloading files tho

@rmn0x01 said:

what causes error on upload feature? I got
Error: Upload failed. Check filenames or paths
Trying on local autocomplete path and full path from source file but still fail

Succeed on downloading files tho

Maybe you don’t have write permissions

Type your comment> @clubby789 said:

@rmn0x01 said:

what causes error on upload feature? I got
Error: Upload failed. Check filenames or paths
Trying on local autocomplete path and full path from source file but still fail

Succeed on downloading files tho

Maybe you don’t have write permissions

make sense. Thanks

menu → Bypass-4MSI → then try to upload again

Thanks for sharing! Using it on daily basis. One of the most used tools from my toolbox.

Type your comment> @CurioCT said:

Any idea what’s wrong with my Ruby install. Had this message using your script and the other one in mentioned in the heist thread

/usr/lib/ruby/vendor_ruby/net/ntlm/client/session.rb:39: warning: constant OpenSSL::Cipher::Cipher is deprecated
/usr/lib/ruby/vendor_ruby/net/ntlm/client/session.rb:128: warning: constant OpenSSL::Cipher::Cipher is deprecated

All ruby newly installed added the winrm gem and the others colorizer etc

in case anyone is seeing this same annoyance it is fixed by updating the ntlm gem

gem install rubyntlm

:smiley: thanks for this fantastic script

For who faced error just run this two-line (root*)

sudo gem install evil-winrm

sudo gem install rubyntlm

Enjoy

Am i the only one getting this with my evil-winrm ?
NOTE: Gem::Specification#rubyforge_project= is deprecated with no replacement. It will be removed on or after 2019-12-01.
Gem::Specification#rubyforge_project= called from /var/lib/gems/2.5.0/specifications/gyoku-1.3.1.gemspec:17.
NOTE: Gem::Specification#rubyforge_project= is deprecated with no replacement. It will be removed on or after 2019-12-01.
Gem::Specification#rubyforge_project= called from /var/lib/gems/2.5.0/specifications/logging-2.2.2.gemspec:18.
NOTE: Gem::Specification#rubyforge_project= is deprecated with no replacement. It will be removed on or after 2019-12-01.
Gem::Specification#rubyforge_project= called from /var/lib/gems/2.5.0/specifications/little-plugger-1.1.4.gemspec:18.
NOTE: Gem::Specification#rubyforge_project= is deprecated with no replacement. It will be removed on or after 2019-12-01.
Gem::Specification#rubyforge_project= called from /var/lib/gems/2.5.0/specifications/nori-2.6.0.gemspec:17.
NOTE: Gem::Specification#rubyforge_project= is deprecated with no replacement. It will be removed on or after 2019-12-01.
Gem::Specification#rubyforge_project= called from /usr/share/rubygems-integration/all/specifications/erubis-2.7.0.gemspec:16.

Evil-WinRM shell v2.3

Info: Establishing connection to remote endpoint

Evil-WinRM PS C:\Users\

System already updated

Is it possible to load powershell modules? For example, rather than loading each script for powersploit, we could just load in powersploit. I could see how with the current way the menu works, that could easily clutter things up though. But overall, I really like the tool!

Perfect. Thanks @spicybyte

Hey. @clubby789 I need some technical help with thie Evil-WinRM tool. I’m recently encountering an issue when i run evil-winrm
"Evil-WinRM shell v2.3

Info: Establishing connection to remote endpoint

Error: An error of type HTTPClient::ReceiveTimeoutError happened, message is execution expired

Error: Exiting with code 1"

This error I got when I try to get user shell in Multimaster.
I can ping that machine from my side.
I tried to rebuild the dependecy tools and reinstalled this gem.
I connected to fresh vpn keys also.
Yet sam problem, later i tried to access other HTB machines using this tool with valid creds, same problem rises there too.
I dont know how to fix it.
I tagged you because of your activeness in this forum.
I really worked on this machine to get valid creds, it took a week. But a last moment for user flag is very depressing me.
Please help me out.

If anyone have solution for my above statement, please share me. I’m feeling helpless.

As you are having the same error on other boxes, I suggest you reinstall it.

I did reinstalled it from scratch. Yet same result. It is really frustrating. I installed Parrot sec OS on my VMWare and tried in that also, same issue happening. I don’t know why it happening.

I worked 8 days to get user creds of the machine, but this error really annoying me to the edge.