← All tool guides

Evil-WinRM (Windows Remote Shell)

Auto-generated by Q-Branch Armory audit on 2026-10-12.

Overview

Ultimate WinRM shell for hacking/pentesting Windows machines.

Classification

**Category:** Post exploitation tools

**Armory status:** Installed (evil-winrm)

**Q-Branch check:** Ready — binary found in PATH

**Present on VPS3:** yes

**Installed flag:** yes

**Primary binary:** `evil-winrm`

**Binary in PATH:** yes

**Resolved path:** `/usr/local/bin/evil-winrm`

Prerequisites

docker

go

java

root

ruby

wifi

Install

gem install evil-winrm

Run

evil-winrm --help

Operator notes

Launch from the [Digital Armory](/pentest/armory/) — do not maintain parallel tool lists in Q-Branch.

If the Q-Branch check is not **Ready**, run install steps or update the HackingTool manifest before relying on this tool in an engagement.

For authorized TenguProtect red-team work only.

Reference

https://github.com/Hackplayers/evil-winrm