pwnrm 2.0.0

Installation

pip (recommended)

pip install pwnrm

# Update when we have new release
# (highly recommend when we have critical issue at previous version)
pip install --upgrade pwnrm

git clone + installer (Kali / Ubuntu / Debian)

git clone https://github.com/uziii2208/PwnRM.git
cd PwnRM
sudo bash install.sh

The installer creates a virtualenv at /opt/pwnrm and registers a global pwnrm wrapper.

Manual / dev

git clone https://github.com/uziii2208/PwnRM.git
cd PwnRM
python3 -m venv venv && source venv/bin/activate
pip install -e .

Usage

# Password
pwnrm -u Administrator -p 'P@ssw0rd!' 192.168.1.10

# Pass-the-Hash
pwnrm -u Administrator -H :aad3b435b51404eeaad3b435b51404ee dc01.corp.local

# Kerberos (ccache / KRB5CCNAME)
pwnrm -u administrator@CORP.LOCAL -k --ccache /tmp/admin.ccache dc01.corp.local

# Client certificate - ADCS abuse paths (ESC1 / ESC9 / Shadow Credentials)
pwnrm -u administrator@CORP.LOCAL --pfx admin.pfx --pfx-pass secret https://dc01:5986

# CredSSP (double-hop / credential delegation)
pwnrm -u admin -p 'P@ss' --credssp dc01.corp.local

# Non-interactive single command
pwnrm -u admin -p 'P@ss' dc01.corp.local -X "whoami /all"

Key flags: --port, --ssl, --timeout, --ts, --debug. Run pwnrm -h for the full list.

Commands

Tab-completion for all built-ins via prompt_toolkit.

AD Triage & Identity Abuse

AD Triage (!adtriage)

!adtriage runs a self-contained LDAP/WMI enumeration entirely inside the remote PowerShell session - no extra binaries on target. -q = quick mode (identity + domain + Server 2025 / BadSuccessor check). Covers: identity & privileges · domain / forest / DCs / trusts · high-value groups · Kerberoastable SPNs · AS-REP roastables · unconstrained / constrained / RBCD delegation · ADCS templates · gMSA / dMSA (BadSuccessor) · ACL quick-wins on DA/DC/krbtgt.

Full ADCS Engine (!adcs) [v2.0]

Comprehensive Active Directory Certificate Services audit covering ESC1 through ESC17+:

• ESC1 / ESC2: Enrollee supplies SAN + Client Auth / Any Purpose EKUs.
• ESC3 / ESC4: Certificate Request Agent & vulnerable template ACL abuse.
• ESC6 / ESC7: CA EDITF_ATTRIBUTESUBJECTALTNAME2 & vulnerable CA permissions.
• ESC17 (WSUS & Code Signing Policy Abuse): Detects Code Signing (1.3.6.1.5.5.7.3.3) / Windows Update templates and scans client registry (HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate) for AcceptTrustedPublisherCerts = 1 and cleartext HTTP WUServer endpoints.

Advanced Kerberos Suite (!kerberos) [v2.0]

• Kerberoast & AS-REP Roast: AES256-CTS-HMAC-SHA1-96 priority (for modern RC4-deprecated AD).
• Diamond Ticket: Identity-swap TGT crafting workflow (evading KDC anomaly detection).
• Server 2025 dMSA / BadSuccessor: Delegated Managed Service Account object & ownership takeover inspection.

Hybrid Entra ID / Cloud Pivot (!entra) [v2.0]

• Device join status (AzureAdJoined, DomainJoined, EnterpriseJoined) via dsregcmd.
• Web Account Manager (WAM) token cache & Primary Refresh Token (PRT) artifact detection.
• Azure CLI (accessTokens.json) and Azure PowerShell context hunting.

Operator Platform Features [v2.0]

In-Band PSRP SOCKS5 Proxy & Port Forwarding (!socks, !portfwd)

• !socks 1080: Spawns a local RFC 1928 SOCKS5 proxy multiplexed over existing WinRM PSRP streams — no listening ports opened on target, zero binary drops.
• !portfwd <LPORT> <RHOST>:<RPORT>: Direct local port forwarding to internal subnet targets.

Multi-Session Manager & Jump Graph (!session)

• !session list: View all active concurrent target runspaces.
• !session switch <id>: Switch interactive context instantly.
• !session exec-all <cmd>: Fan-out command execution across all target nodes.
• !session save: Encrypted session state serialization under ~/.pwnrm/sessions/.

Modular Attack Engine & Playbooks (!module, !playbook)

• !module list / run <name>: Dynamic plugin loader for Python and PowerShell modules.
• !playbook --run <name>: Declarative automation runner (default_triage, ad_recon, stealth_audit).
• !loot: Structured credential and artifact inventory organized per target (~/.pwnrm/loot/<target>/).
• !opsec [stealth|balanced|aggressive|hybrid-cloud]: Configurable traffic shaping and jitter sleep.

Share Scout

!shares runs a self-contained SMB share enumeration entirely inside the remote PowerShell session - no extra binaries on target. -q = quick mode (local shares + UNC probe only). Optionally pass explicit [HOST ..] to scan remote machines; without targets, auto-discovers domain computers via AD (capped at 20 hosts). Covers: local share inventory via Win32_Share · UNC access testing (read and write probe) · ACL quick-wins flagging Everyone / Authenticated Users with write rights · SYSVOL/NETLOGON sensitive file sweep · GPP cPassword auto-detection (CVE-2014-1812) · open files (net files) · active SMB sessions (net session).

Session Scout

!sessions runs a self-contained active logon session and network snapshot entirely inside the remote PowerShell session - no extra binaries on target. -q = quick mode (logon sessions + RDP MRU only). Covers: interactive / remote / service logon sessions via Win32_LogonSession · RDP client MRU and saved credentials from registry · Kerberos ticket cache (klist) with TGT flagging · established TCP connections with process attribution and external IP detection · listening port inventory with service labels (RDP, MSSQL, WinRM, etc.) · named pipe exposure with sensitive pipe flagging (lsass, spoolss, samr, epmapper...) · SYSTEM-level scheduled tasks currently running.

Library Usage

from pwnrm import Runspace, PwnShell, create_transport, argument_parser, SessionManager, Socks5Server

args = argument_parser().parse_args(["-u", "admin", "-p", "P@ss", "10.0.0.5"])
with Runspace(create_transport(args), int(args.timeout)) as rs:
    shell = PwnShell(rs)
    print(shell.run_sync("whoami /all"))        # blocking
    for out in rs.run_command("Get-Process"):   # streaming
        print(out)

Directory Structure

PwnRM/
├── src/pwnrm/
│   ├── __init__.py            # public API & version 2.0.0
│   ├── __main__.py            # python -m pwnrm
│   ├── cli.py                 # CLI entry point (UTF-8 hardened)
│   ├── core/                  # Transport, Runspace, SessionMgr, Tunnel, Loot, OPSEC
│   ├── modules/               # ADCS (ESC1-17+), Kerberos, Entra, Creds, Evasion, BloodHound, Lateral, Playbook
│   ├── shell/                 # PwnShell v2.0 REPL, built-in commands, UI
│   └── resources/             # adtriage.ps1 · shares.ps1 · sessions.ps1
├── tests/                     # 15 automated unit & security regression tests
├── CHANGELOG.md               # Full release & security advisory history
├── pyproject.toml             # PyPI packaging (v2.0.0)
├── install.sh                 # Linux installer
└── requirements.txt

Troubleshooting

⚠️ Disclaimer

PwnRM is for authorized security testing, red-team operations, and education only. You must have explicit written authorization (RoE / signed scope) before targeting any system. The authors assume no liability for misuse. Never use against systems you do not own or lack permission to test.

Credits

Core author: uziii2208 · Built on Impacket · Concept: original winrmexec.py

License

MIT - see LICENSE.