> For the complete documentation index, see [llms.txt](https://aidenpearce369.gitbook.io/handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aidenpearce369.gitbook.io/handbook/ad-pentesting/lateral-movement/powershell-remoting.md).

# POWERSHELL REMOTING

Uses TCP 5985 & TCP/SSL 5986

To enable PowerShell Remoting

```
Enable-PSRemoting
```

To connect to a remote computer where current user has local admin access

```
Enter-PSSession -ComputerName <COMPUTER NAME>
```

To store a session of a remote computer where current user has local admin access

```
$sess = New-PSSession -ComputerName <COMPUTER NAME>
```

Execute commands on remote machine via PSRemoting where our current user is local admin on the remote machine

```
Invoke-Command -ComputerName <COMPUTER NAME> -ScriptBlock {whoami}
```

Execute commands on remote machine via PSRemoting where our current user is local admin session on the remote machine&#x20;

```
Invoke-Command -SessionName <SESSIONNAME> -ScriptBlock {whoami}
```

To copy a file from local machine to remote server where current user has local admin access

```
Copy-Item -Path <PATH TO FILE> -Destination <DESTINATION PATH ON REMOTE> -ToSession $sess
```

To copy a file from remote machine where current user has local admin access

```
Copy-Item -Path <PATH TO FILE> -Destination <DESTINATION PATH ON LOCAL> -FromSession $sess
```

To load PowerShell scripts from local machine to the remote machine where our current user is local admin on the remote machine

```
Invoke-Command -Computername <COMPUTER NAME> -FilePath <LOCAL PATH FOR SCRIPT>
```

To load PowerShell scripts from local machine to the remote machine with local admin session of current user

```
Invoke-Command -Session $sess -FilePath <LOCAL PATH FOR SCRIPT>
```

To load a function from local powershell memory into remote machine where our current user has local admin access

```
Invoke-Command -Scriptblock ${function:<FUNCTION>} -Computername <COMPUTER NAME>
```

To load a function from local powershell memory into remote machine with local admin session of current user

```
Invoke-Command -Scriptblock ${function:<FUNCTION>} -Session $sess
```

If the remote machine prompts for authentication, store the credential of the current user which is a local admin on the remote machine

```
$cred = Get-Credential -Credential <DOMAIN\USERNAME>
```

Pass the `$cred` variable with `-Credential` parameter for the above commands