Skip to content

WinRM and PsExec

They both allow executing commands on a remote machine with a command-line interface. They can both execute one single command or launch an interactive command prompt (cmd.exe for PsExec, a PowerShell session for WinRM).

The account on the remote machine can be a domain account (Domain\User), a local account (of the remote machine), or can be omitted.

  • If a domain account is used, commands can be executed only if the account is an administrator of the remote machine (a member of the local Administrators group).
  • If a local account is used, commands can be executed only if the account is the built-in Administrator account (or if LocalAccountTokenFilterPolicy has been set to 1 on the remote machine, in which case any local administrator account works).
  • If omitted, PsExec passes through the credentials of the currently logged-on session with the same rules as above. If the session is a local logon, the Administrator password on the local machine must be identical to the one on the other machine for NTLM authentication to succeed.

In the case of WinRM, domain or local accounts that are member of the Remote Management Users group are also allowed to execute commands, without requiring administrator rights.

WinRM

WinRM (Windows Remote Management) is the Microsoft implementation of the WS-Management protocol:

  • It runs as a service that listens on HTTP/HTTPS (5985/5986) and handles authentication,encryption, and routing of WS-Man SOAP messages.
  • It is a generic remote-management transport that can host different "plugins", PowerShell being one of those.

When you run the PowerShell Enter-PSSession or Invoke-Command cmdlets on the local machine, PowerShell will connect to the specified, remote WinRM service; this service will spawn a child process to run a PowerShell instance.

Some PowerShell cmdlets have a ComputerName parameter that can be used to run commands on a remote computer. Depending on the specific cmdlet, this may or may not use WinRM. Many legacy cmdlets (e.g., Get-WmiObject, Get-Service, Restart-Computer) use RPC/DCOM instead. Newer cmdlets (e.g., Get-CimInstance) use WinRM/WSMan.

PsExec

PsExec drops and runs an arbitrary binary as a service. It interacts with the network as follows:

  • It establishes an SMB session with the remote machine and authenticates (TCP port 445 or legacy TCP port 139).
  • It connects to the ADMIN$ share and to the IPC$ share. The former is for uploading files, the latter is for interacting with the Service Control Manager on the remote machine through Named Pipes (Microsoft Remote Procedure Call - RPC).
  • It uploads the service executable PSEXESVC.exe.
  • It creates a service pointing at the uploaded executable and starts the service.
  • The service has its stdin, stdout, stderr redirected back to PsExec with the dynamically created Named Pipes over the SMB connection.
  • The service will spawn the requested command (including a shell) as a child process; stdin, stdout, stderr of that process are redirected to the service (and then back to PsExec) with Named Pipes.