evil-winrm

No entries match these filters. Clear filters

1. docs update Oct 10, 2026 · issue 101

   evil-winrm gains a quit command, Ctrl+D exit support, Ruby 4.0 compatibility, and keepalive for idle WinRM shells.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Exit an active evil-winrm session cleanly without killing your terminal.
   copy

   $ quit

   • Adds quit command and Ctrl+D exit support for cleanly leaving a WinRM session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Ruby 4.0 support.
   • Adds quit command and Ctrl+D exit support for cleanly leaving a WinRM session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

2. docs update Sep 3, 2026 · issue 063

   evil-winrm: Adds quit command and Ctrl+D support for cleanly exiting the shell.

3. v4.1 Sep 3, 2026 · issue 063

   evil-winrm v4.1 adds a quit command, Ctrl+D exit support, keepalive for idle shells, and Ruby 3.3/4.0 compatibility.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.1 https://github.com/Hackplayers/evil-winrm.git
   # already have the repo? check out this version:
   $ git checkout v4.1

   • Adds quit command inside the shell as an explicit exit mechanism.
   • Adds Ctrl+D support as an alternative way to exit the shell session.
   • Adds keepalive to prevent Windows from disconnecting idle WinRM shells.
   • Adds readline-ext as a required dependency to restore remote path completion compatibility with Ruby 3.3 and newer.
   • Adds Ruby 4.0 support.

   5 details in Everything

4. docs update Sep 1, 2026 · issue 061

   Evil-WinRM AI branch adds integrated LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. support via --llm, --llm-model, --llm-url, and --llm-api-key flags for in-shell PowerShell command generation

   └──▷ TRY IT
   Connect to a Windows host and attach a local Ollama instance for AI-assisted PowerShell command generation during the session.
   copy

   $ evil-winrm-ai -i 192.168.1.100 -u Administrator -p "$WINRM_PASSWORD" --llm Ollama --llm-model llama3 --llm-url http://localhost:11434

   Use OpenAI as the LLM provider and persist generated commands to shell history for later review.
   copy

   $ evil-winrm-ai -i 192.168.1.100 -u Administrator -p "$WINRM_PASSWORD" --llm OpenAI --llm-model gpt-4o --llm-api-key "$OPENAI_API_KEY" --llm-history

   Run the AI-enabled shell in a Docker container, mounting local script and exe directories, with Anthropic as the LLM provider.
   copy

   $ docker run --rm -ti --name evil-winrm-ai -v /home/foo/ps1_scripts:/ps1_scripts -v /home/foo/exe_files:/exe_files -v /home/foo/data:/data oscarakaelvis/evil-winrm:ai -i 192.168.1.100 -u Administrator -p "$WINRM_PASSWORD" -s '/ps1_scripts/' -e '/exe_files/' --llm Anthropic --llm-model claude-3-5-sonnet-20241022 --llm-api-key "$ANTHROPIC_API_KEY"

   • Adds --llm LLM_NAME flag to select an LLM provider (Ollama, OpenAI, Anthropic, Mistral-AI, Gemini, AzureOpenAI) for in-session PowerShell command suggestions.
   • Adds --llm-model LLM_MODEL_NAME flag to specify the exact model to use with the chosen LLM provider.
   • Adds --llm-url LLM_URL flag to point to a self-hosted LLM service endpoint (used by Ollama and AzureOpenAI).
   • Adds --llm-api-key LLM_API_KEY flag to supply the API key for cloud LLM providers.
   • Adds --llm-history flag to save LLM-generated commands to the shell history (default false).

   +3 more show less

   • Adds --llm-debug flag to enable LLM provider logging for troubleshooting (default false).
   • Ships as a new gem evil-winrm-ai and script evil-winrm-ai.rb, installable via gem install evil-winrm-ai, with a dedicated :ai-tagged Docker image oscarakaelvis/evil-winrm:ai.
   • Requires langchainrb >= 0.18.0 plus provider-specific gems (ollama-ai >= 1.3.0, anthropic >= 0.3.2, mistral-ai >= 1.2.0, ruby-openai >= 7.3.1) when LLM features are used.

   8 details in Everything

5. docs update Aug 17, 2026 · issue 048

   evil-winrm v3.9 adds KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ccache/kirbi ticket file auth, reverse DNS FQDN resolution, and a custom user-agent flag

   └──▷ TRY IT
   Authenticate using a Kerberos ccache ticket exported from impacket or a kirbi file from Mimikatz, without needing to set KRB5CCNAME manually.
   copy

   $ evil-winrm -i dc01.contoso.com -r CONTOSO.COM -K /tmp/admin.ccache

   Connect over WinRM while spoofing a custom user-agent to blend in with legitimate WinRM traffic.
   copy

   $ evil-winrm -i 192.168.1.10 -u Administrator -p 'P@ssw0rd' -a 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'

   Use a Kerberos kirbi ticket with a non-default SPN prefix (e.g. for HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate.-based WinRM) and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. enabled.
   copy

   $ evil-winrm -i dc01.contoso.com -r CONTOSO.COM -K /tmp/admin.kirbi --spn HTTPS -S

   • Adds -K/--ccache TICKET_FILE flag to load a Kerberos ticket directly from a ccache or kirbi file, with auto-detection of format and automatic KRB5CCNAME environment variable management (including cleanup on exit).
   • Adds --spn SPN_PREFIX flag to override the SPN prefix used for Kerberos authentication (default HTTP).
   • Adds -a/--user-agent USERAGENT flag to specify a custom WinRM connection user-agent string (default Microsoft WinRM Client).
   • Adds -N/--no-rpath-completion flag to disable remote path completion.

   4 details in Everything

6. 3.8 Dec 7, 2025 · release notes

   evil-winrm 3.8 adds KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ccache/kirbi support with -K flag and persistent command history

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.8 https://github.com/Hackplayers/evil-winrm.git
   # already have the repo? check out this version:
   $ git checkout 3.8

   • Adds -K flag to load Kerberos ticket files (ccache and kirbi formats) with automatic format detection/conversion and optional reverse DNS lookup for FQDN
   • Adds persistent command history per user/host, stored in ~/.evil-winrm/history/
   • Adds clear, cls commands and Ctrl+L support for clearing screen

   3 details in Everything

7. 3.6 Oct 6, 2024 · release notes

   evil-winrm 3.6 adds --user-agent, new ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. bypasses, and AMSI refactor.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.6 https://github.com/Hackplayers/evil-winrm.git
   # already have the repo? check out this version:
   $ git checkout 3.6

   • Adds --user-agent option to control the HTTP User-Agent header
   • Refactors the internal AMSI bypass implementation

   2 details in Everything

8. 3.5 Apr 21, 2023 · release notes

   evil-winrm 3.5 adds simple wildcard support for upload and download commands.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.5 https://github.com/Hackplayers/evil-winrm.git
   # already have the repo? check out this version:
   $ git checkout 3.5

   └──▷ USE IT
   Upload multiple files matching a pattern to the remote host.
   shell copy

   evil-winrm -i <target> -u <user> -p <pass> --upload '/local/path/*.log'

   Download all configuration files from the remote host.
   shell copy

   evil-winrm -i <target> -u <user> -p <pass> --download '/remote/path/*.conf' /local/dir/

   • Improves powershell functions loading

   1 detail in Everything

9. 2.4 Mar 9, 2021 · release notes

   evil-winrm 2.4 adds -S flag for custom SPN in KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. auth

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2.4 https://github.com/Hackplayers/evil-winrm.git
   # already have the repo? check out this version:
   $ git checkout 2.4

10. 2.2 Jan 30, 2020 · release notes

    evil-winrm 2.2 adds file upload/download progress bars and fixes argument parsing in Invoke-Binary

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.2 https://github.com/Hackplayers/evil-winrm.git
    # already have the repo? check out this version:
    $ git checkout 2.2

    • Adds a visual progress bar for remote file uploads and downloads to improve user feedback during large transfers

    1 detail in Everything