Enable Windows remote access (WinRM, PSRP & WMI)

Enable Windows remote access (WinRM, PSRP & WMI)

Before the Attack Vector can reach a Windows System Target, remote access must be enabled on that machine. BlackNoise supports two protocols — WinRM (with NTLM authentication), PSRP or WMI. Enable whichever you plan to use.


Run every command below as administrator, a local admin account, or a domain account with local admin rights on the machine.
Shared requirement: LocalAccountTokenFilterPolicy. For remote access with a local admin account, this registry key must be set to 1, for both WinRM and WMI:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy
Microsoft's rationale: in a workgroup using Negotiate authentication, only the built-in Administrator account can access the service unless this value is 1, which grants access to all accounts in the Administrators group. A GPO can overwrite this key, so re-check it if remote access stops working.


WinRM / PSRP

Enable

    In an administrator PowerShell, run:
Enable-PSRemoting -Force
This enables the WinRM service, adds a listener on port 5985, and creates a Windows Firewall rule.
Expected output:
WinRM service type changed successfully.
WinRM service started.
WinRM firewall exception enabled.
Configured LocalAccountTokenFilterPolicy to grant administrative rights remotely to local users.
    Check that TCP 5985 is reachable between the target and the Attack Vector. Step 1 already added the rule to the local Windows Firewall; open the port only if another host firewall, or a network firewall between the subnets, still blocks it.
    Confirm LocalAccountTokenFilterPolicy is set to 1 (see above).

Test (optional)

Prefer testing from the BlackNoise web app (Resources > System Targets, connection test at creation or from the detail view). To test from your own machine instead, use the BlackNoise script available for download below. Run it as admin from any Windows machine with access to the target, not from the target itself:
  • Local admin account:
powershell .\blacknoise_check_winrm-v1.1.ps1 -Local -ComputerName <target> -UserName <user>
  • Domain account with local admin rights:
powershell .\blacknoise_check_winrm-v1.1.ps1 -ComputerName <target> -DomainName <domain> -UserName <user>
Enter the account password at the prompt.
On success you get SUCCESS: Connection to <ip address> with admin successful.
The flows validated by the script must also be open from the BlackNoise Attack Vector for access to work in production.
Script: blacknoise_check_winrm-v1.1.ps1

blacknoise_check_winrm-v1.1.ps1
3KB, Uploaded 4 days ago

Troubleshooting

  • Public firewall profile. Enable-PSRemoting opens the flow on the Domain and Private profiles, but not Public. If the interface used to reach the Attack Vector is on the Public profile, either move it to Domain or Private, or add or modify a firewall rule to open the flow on Public.
  • Access still fails after a success message. Log in to the target and confirm LocalAccountTokenFilterPolicy = 1 (a GPO may have reset it).


WMI

The WMI scripts are compatible with Windows 2016 and later.

Enable

    In an administrator PowerShell, run the enable script with default parameters:
powershell -ep bypass -f blacknoise_enable_wmi-v1.3.ps1 -f -w -v
Or with specific parameters:
powershell -ep bypass -f blacknoise_enable_wmi-v1.3.ps1 -f -w -v -p xxxx-yyyy -z zoneA,zoneB,zoneC
  • -p — the range of ports used for WMI connections
  • -z — the firewall zones for which a rule is opened
    Reboot the target.
    Check that the required ports are reachable between the target and the Attack Vector. The enable script already added the rules to the local Windows Firewall; open the ports only if another host firewall, or a network firewall between the subnets, still blocks them:
  • RPC: TCP 135
  • SMB: TCP 445
  • Dynamic RPC range: TCP 60000–61000, or the range set with -p. Windows' default dynamic range is 49152–65535.
    Confirm LocalAccountTokenFilterPolicy is set to 1 (see above).
Script: blacknoise_enable_wmi-v1.3.zip

blacknoise_enable_wmi-v1.3.zip
2KB, Uploaded 4 days ago
Upon successful execution, you should receive a return as illustrated below:

Test (optional)

As with WinRM, prefer the web app test. To test from your own machine, run as admin from a Windows machine with access to the target, not from the target itself:
powershell -f .\blacknoise_check_wmi-v1.0.ps1 target user password domain
target, user and password are required; domain is optional.
On success you get Success: Successfully retrieved remote computer name.
Script: blacknoise_check_wmi-v1.0.zip

blacknoise_check_wmi-v1.0.zip
3KB, Uploaded 4 days ago

Troubleshooting

Access still fails after a success message. Log in to the target and confirm LocalAccountTokenFilterPolicy = 1 (a GPO may have reset it).