Metasploit-framework: WinRM Authentication Issue (HTTP Error 500)

[curi0usJack]

Steps to reproduce

Firing commands using the auxiliary/scanner/winrm/winrm_cmd fails with an HTTP 500.

Confirmed WinRM is working correctly using the following commands via meterpreter PowerShell extension:

(Yes, routing is setup properly). Victim host is Windows 10. Target is Windows Server 2012 R2. Both NTLM & Kerberos auth options confirmed open.

Wireshark on the victim is revealing interesting data.

Properly working request (from Invoke-Command):

Failing request (winrm_cmd):

Seems as though the second response of NTLM negotiation is being truncated by metasploit, but not positive.

System stuff

Metasploit version - 4.15.2-dev

I installed Metasploit with:

• [x] Kali package via apt

OS

What OS are you running Metasploit on? Kali

[curi0usJack]

I enabled analytical logging on the target and caught the following message:

I know I can enable unencrypted messages on the target, but that would be a security downgrade. Any metasploit options to do this that I'm not seeing?

[sempervictus]

What's the crypto scheme they use? A few are implemented in Rex and ruby-smb... Maybe we can port em if missing from winrm.
Ping @dmaloney-r7

[thelightcosine]

The current WinRM implementation in Metasploit does not support encrypted communication or kerberos.

[AndyXan]

this seems to be unchanged for 2 years now. I stumbled upon the very same problem during a Hackthebox machine (heist) again this year. Are there any plans to support this currently?

A working implementation is provided (in ruby already) by https://github.com/WinRb/WinRM, which works kinda good.

[0ca]

Same problem here with a different Hackthebox machine.
It worked perfectly with evil-winrm coded also in Ruby:
https://github.com/Hackplayers/evil-winrm