> For the complete documentation index, see [llms.txt](https://www.netexec.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.netexec.wiki/winrm-protocol/authentication.md).

# Authentication

### WinRM Authentication

#### Testing credentials

```bash
nxc winrm 192.168.1.0/24 -u user -p password
```

Expected Results:

```bash
WINRM       192.168.255.131 5985   ROGER            [*] http://192.168.255.131:5985/wsman
WINRM       192.168.255.131 5985   ROGER            [+] GOLD\user:password (Pwn3d!)
```

If the SMB port is closed you can also use the flag `-d DOMAIN` to avoid an SMB connection

```bash
nxc winrm 192.168.1.0/24 -u user -p password -d DOMAIN
```

Expected Results:

```bash
WINRM       192.168.255.131 5985   192.168.255.131  [*] http://192.168.255.131:5985/wsman
WINRM       192.168.255.131 5985   192.168.255.131  [+] GOLD\user:password (Pwn3d!)
```

### Example

Monteverde machine is a good example to test **WinRM** procotol with NetExec

{% embed url="<https://www.hackthebox.com/machines/monteverde>" %}