PowerShell Remoting

PowerShell remoting is a protocol that allows to run PowerShell commands remote systems; it was first introduced in PowerShellV2 and it's based on the Simple Object Access Protocol. It is considered a firewall-friendly protocol as it only uses one port

• 5985 for HTTP

• 5986 for HTTPS

and provides temporary persistence.

Traffic sent with the protocol is encrypted by default with AES256 and authentication is handled by Kerberos - this means that the credentials are not passed to the remote system at all, only to the DC and KDC, eliminating the chances of an attacker harvesting them from the remote system.

To set the protocol up we need to do the following

1. Start the WinRM service

Start-Service -Name WinRM

2. Set the WinRM service startup type to Automatic

Set-Service -Name WinRM -StartupType Automatic

3. Create a WinRM listener (HTTP or HTTPS)

# ensure that WinRM is enabled and create a listener for HTTP
winrm quickconfig -force

# ensure that WinRM is enabled
winrm quickconfig -force

# create an HTTPS listener (requires a certificate)
# replace "YOUR_CERT_THUMBPRINT" with the thumbprint of your certificate
# replace "YOUR_DOMAIN_OR_IP" with your domain name or IP address

$certThumbprint = "YOUR_CERT_THUMBPRINT"
$urlPrefix = "https://+:5986/wsman/"
winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname="YOUR_DOMAIN_OR_IP"; CertificateThumbprint=$certThumbprint}

4. Allow WinRM requests through local firewall

# allow inbound HTTP WinRM traffic on port 5985
New-NetFirewallRule -Name "Allow WinRM HTTP" -DisplayName "Allow WinRM HTTP" -Enabled True -Profile Any -Action Allow -Direction Inbound -Protocol TCP -LocalPort 5985

# allow inbound HTTPS WinRM traffic on port 5986
New-NetFirewallRule -Name "Allow WinRM HTTPS" -DisplayName "Allow WinRM HTTPS" -Enabled True -Profile Any -Action Allow -Direction Inbound -Protocol TCP -LocalPort 5986

WinRM listeners can be HTTP or HTTPS; WinRM traffic is encrypted by default in both cases but HTTPS listeners need server authentication for non-domain systems.

By default, the ACL for each PowerShell remote endpoint grant access to NT AUTHORITY\INTERACTIVE, Administrators and Remote Management Users. The ACLs can be seen with

Get-PSSessionConfiguration | Select-Object -ExludeProperty Permission

PS remoting is limited to systems that are domain-joined and use Kerberos authentication.

This limitation is in place to guarantee mutual authentication.

To know if PS remoting is enabled on a remote computer we can use the Test-WSMan command

Test-WSMan -ComputerName 10.10.10.10

If remoting is enabled, we can create a new PS session with the right credentials

$session = New-PSSession -ComputerName 10.10.10.10 -Credential administrator
Enter-PSSession -Session $session

CIM sessions got introduced with PowerShellV3, the main use for these sessions is creating reusable sessions to reduce authentication overhead.

$session = New-CimSession -ComputerName localhost
Get-CimInstance -CimSession $session -CassName Win32_Process

It's possible to execute scripts, functions or scriptblocks remotely with a saved session

Invoke-Command -Session $sessions[3] -FilePath script.ps1

function hello {Write-Host "hi"}
Invoke-Command -Session $sessions[3] -ScriptBlock ${ function:hello }

Invoke-Command -Session $sessions[3] -ScriptBlock ${ Write-Host "hi" }