<h1 align="center">nimrm</h1>

<p align="center">
  <a href="https://github.com/blue0x1/nimrm/releases"><img src="https://img.shields.io/github/v/release/blue0x1/nimrm" alt="Release"></a>
  <a href="https://github.com/blue0x1/nimrm/releases"><img src="https://img.shields.io/github/downloads/blue0x1/nimrm/total.svg" alt="Downloads"></a>
</p>

<p align="center">
  <b>Native WinRM shell client written in Nim</b>
</p>

<p align="center">
  <sub>
    <b>Version</b> 1.2.0 ·
    <b>Author</b> Chokri Hammedi (blue0x1) ·
    <b>License</b> MIT
  </sub>
</p>

<p align="center">
  <img src="https://img.shields.io/badge/NTLM-08f5f9?style=for-the-badge" alt="NTLM">
  <img src="https://img.shields.io/badge/Kerberos-fc1383?style=for-the-badge" alt="Kerberos">
  <img src="https://img.shields.io/badge/PowerShell-08f5f9?style=for-the-badge" alt="PowerShell">
  <img src="https://img.shields.io/badge/File%20Transfer-fc1383?style=for-the-badge" alt="File Transfer">
  <img src="https://img.shields.io/badge/In--Memory-08f5f9?style=for-the-badge" alt="In-Memory Helpers">
  <img src="https://img.shields.io/badge/Multi--Session-fc1383?style=for-the-badge" alt="Multi-Session">
</p>

<p align="center">
  <a href="https://github.com/blue0x1/nimrm/wiki"><img src="https://img.shields.io/badge/Documentation-08f5f9?style=for-the-badge&logo=gitbook&logoColor=black" alt="Documentation"></a>
  <a href="https://github.com/blue0x1/nim-winrm"><img src="https://img.shields.io/badge/WinRM%20Library-fc1383?style=for-the-badge&logo=nim&logoColor=white" alt="WinRM Library"></a>
</p>

---
<img width="1024" height="595" alt="image" src="https://github.com/user-attachments/assets/ee35bbe2-9d5b-4b98-9bf8-78e3286a1219" />


## Legal Notice

`nimrm` is intended for lawful administration, security testing, and research on systems you own or have explicit permission to access. The author is not responsible for misuse or damage caused by this tool.

## Table of Contents

- [Overview](#overview)
- [Features](#features)
- [Requirements](#requirements)
- [Installation](#installation)
- [Build](#build)
- [Performance](#performance)
- [Usage](#usage)
- [Options](#options)
- [Interactive Commands](#interactive-commands)
- [Session Management](#session-management)
- [Examples](#examples)
- [Notes](#notes)
- [License](#license)

## Overview

`nimrm` provides a compact and fast WinRM shell with practical authentication, command execution, transfer, and reporting helpers. It is built as a native Nim binary with no Nim package dependencies.

## Features

| Area | Support |
| --- | --- |
| Authentication | NTLM password, NTLM hash, Kerberos via `KRB5CCNAME` |
| WinRM transport | HTTP, HTTPS/TLS, custom port |
| Shell | Interactive PowerShell, CMD prefix, one-shot command mode, command and local path autocomplete |
| Transfers | File upload/download, recursive directory transfer, remote session-to-session file and directory relay |
| In-memory | PowerShell script import, managed .NET assembly execution |
| Reporting | AD/domain context, logging and auditing posture |
| Reliability | Kerberos message wrapping, transport reset/retry handling |

## Requirements

| Component | Requirement |
| --- | --- |
| Build | Nim `>= 1.6.0` |
| Kerberos | `libgssapi_krb5.so.2` on Linux or `libgssapi_krb5.dylib` on macOS |
| TLS build | OpenSSL and `-d:ssl` |
| Target | WinRM reachable on the selected port |

## Installation

Nimble:

```bash
nimble install nimrm
```

Download the latest release:

```bash
curl -L -o nimrm https://github.com/blue0x1/nimrm/releases/latest/download/nimrm
chmod +x nimrm
```

Windows release binary:

```powershell
Invoke-WebRequest -Uri https://github.com/blue0x1/nimrm/releases/latest/download/nimrm.exe -OutFile nimrm.exe
```

Debian package:

```bash
curl -L -o nimrm_1.2.0_amd64.deb https://github.com/blue0x1/nimrm/releases/latest/download/nimrm_1.2.0_amd64.deb
sudo dpkg -i nimrm_1.2.0_amd64.deb
```

BlackArch:

```bash
sudo pacman -S nimrm
```

The BlackArch PKGBUILD tracks the latest upstream git commit, so new releases reach BlackArch users on their next system update. If `nimrm` is already installed, upgrade it with:

```bash
sudo pacman -Syu nimrm
```

Build from source:

```bash
git clone https://github.com/blue0x1/nimrm.git
cd nimrm
make linux
```

## Build

```bash
make linux
```

```bash
make ssl
```

```bash
make windows
```

Manual build:

```bash
nim c -d:release --opt:speed -o:nimrm nimrm.nim
```

## Performance

`nimrm` is designed to stay fast by using a native Nim binary, persistent WinRM runspace, chunked transfer logic, and compact progress rendering.

| Operation | Implementation |
| --- | --- |
| Upload | Chunked Base64 writes with adaptive retry on large envelopes |
| Download | Streamed Base64 chunks with progress tracking and a fast path for small files |
| Remote session relay | Reads from one WinRM session and writes to another through controller memory without writing the file to local disk |
| Directory transfer | Recursive file enumeration using the same chunked transfer path |
| Command execution | Reuses the active WinRM shell/runspace instead of reconnecting per command |

## Usage

NTLM password:

```bash
./nimrm -T 192.168.1.10 -A 'CORP\administrator' -P 'Password123'
```

NTLM pass-the-hash:

```bash
./nimrm -T 192.168.1.10 -A 'CORP\user' -N aad3b435b51404eeaad3b435b51404ee:0123456789abcdef0123456789abcdef
```

Kerberos:

```bash
KRB5CCNAME=FILE:/tmp/user.ccache ./nimrm -k -T dc01.corp.local -Z CORP.LOCAL
```

Force NTLM message encryption over HTTP:

```bash
./nimrm -T 192.168.1.10 -A 'CORP\user' -P 'Password123' --seal
```

Custom port:

```bash
./nimrm -T 192.168.1.10 -A 'CORP\user' -P 'Password123' -p 5985
```

One-shot command:

```bash
./nimrm -T 192.168.1.10 -A 'CORP\user' -P 'Password123' -c 'whoami'
```

Skip TLS certificate verification (self-signed certs):

```bash
./nimrm -T 192.168.1.10 -A 'CORP\user' -P 'Password123' --tls --insecure
```

## Options

| Option | Description |
| --- | --- |
| `-T`, `--target` | Target IP or hostname |
| `-A`, `--account` | Username: `user`, `user@domain`, or `DOMAIN\user` |
| `-P`, `--secret` | NTLM password |
| `-p`, `--port` | WinRM port |
| `-N`, `--nt-proof` | NT hash or `LM:NT` hash |
| `-Z`, `--krb-zone` | Kerberos realm override |
| `-K`, `--kerb-spn` | Kerberos SPN override |
| `-k`, `--kerb` | Use Kerberos authentication |
| `-c`, `--command` | Execute one command and exit |
| `--tls` | Use HTTPS/TLS |
| `--insecure` | Skip TLS certificate verification |
| `-h`, `--help` | Show help |

## Interactive Commands

| Command | Description |
| --- | --- |
| `/help` | Show help |
| `exit`, `quit` | Close shell |
| `!<cmd>` | Run through `cmd.exe` |
| `upload <local> [remote]` | Upload one file |
| `download <remote> [local]` | Download one file |
| `rupload <remote> <session> [dest]` | Copy a remote file from the active session to another session through memory |
| `rdownload <session> <remote> [dest]` | Copy a remote file from another session to the active session through memory |
| `rupload-dir <remote> <session> [dest]` | Copy a remote directory from the active session to another session through memory |
| `rdownload-dir <session> <remote> [dest]` | Copy a remote directory from another session to the active session through memory |
| `upload-dir <local> [remote]` | Upload a directory |
| `download-dir <remote> [local]` | Download a directory |
| `invoke-script <ps1> [args]` | Import local PowerShell from memory |
| `execute-assembly <exe> [args]` | Run managed .NET from memory |
| `ad-info` | Show AD/domain context |
| `opsec-check` | Show logging and auditing posture |
| `sessions` | List all active sessions |
| `session <opts>` | Create a new session |
| `use <name\|id>` | Switch to a session |
| `kill <name\|id>` | Close and remove a session |

## Session Management

nimrm supports multiple concurrent WinRM sessions. You can pivot between different hosts and users without leaving the shell.

Create a new session from inside an existing one:

```powershell
PS C:\Users\Administrator> session -T 10.0.0.5 -A 'CORP\user2' -P 'Pass123'
PS C:\Users\Administrator> session -T dc02.corp.local -A user@corp.local -N aad3b435:0123456789abcdef -n dc02
PS C:\Users\Administrator> session -T dc03.corp.local -k -Z CORP.LOCAL -n dc03
```

List active sessions:

```
PS C:\Users\Administrator> sessions

  ID  Name              Target                    User              Auth
  --  ----              ------                    ----              ----
 * 1  session-1         dc01.corp.local:5985      administrator     Kerberos
   2  session-2         10.0.0.5:5985             user2             NTLM
   3  dc02              dc02.corp.local:5985      user              NTLM
```

Switch between sessions:

```powershell
[session-2] PS C:\Users\user2> use 1
[*] Switched to session: session-1 (dc01.corp.local:5985)
[session-1] PS C:\Users\Administrator> use dc02
[*] Switched to session: dc02 (dc02.corp.local:5985)
```

Close a session:

```powershell
[dc02] PS C:\Users\user> kill 2
[*] Killed session: session-2
```

Copy files between active sessions:

```powershell
[session-1] PS C:\Users\user1> rupload C:\Users\user1\tool.exe session-2 C:\Users\user2\Desktop\tool.exe
[*] Download mode: WinRS binary stream
✔  rupload-read  [━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━]  100%  442.0 KB/442.0 KB  done in 0.7s
[*] Upload mode: WinRS stream
✔  rupload-write  [━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━]  100%  442.0 KB/442.0 KB  done in 0.4s
[+] Remote uploaded 452608 bytes from session-1:C:\Users\user1\tool.exe to session-2:C:\Users\user2\Desktop\tool.exe

[session-1] PS C:\Users\user1> rdownload session-2 C:\Users\user2\Desktop\out.txt C:\Users\user1\out.txt
[+] Remote downloaded 1024 bytes from session-2:C:\Users\user2\Desktop\out.txt to session-1:C:\Users\user1\out.txt
```

`rupload` and `rupload-dir` use the active session as the source and the named session as the destination. `rdownload` and `rdownload-dir` use the named session as the source and the active session as the destination. These commands relay bytes through `nimrm` memory, so the controller host does not write a temporary copy to disk.

Session options:

| Option | Description |
| --- | --- |
| `-T` | Target host |
| `-A` | Username |
| `-P` | Password |
| `-N` | NT hash |
| `-k` | Kerberos auth |
| `-Z` | Kerberos realm |
| `-K` | SPN override |
| `-p` | Port |
| `--tls` | Use HTTPS |
| `-n` | Custom session name |

## Examples

PowerShell and CMD:

```powershell
PS> hostname
PS> Get-Process
PS> !ipconfig /all
```

Transfers:

```powershell
PS> upload ./tool.exe C:\Temp\tool.exe
PS> download C:\Temp\out.txt ./out.txt
PS> rupload C:\Temp\tool.exe session-2 C:\Temp\tool.exe
PS> rdownload session-2 C:\Temp\out.txt C:\Temp\out.txt
PS> rupload-dir C:\Temp\logs session-2 C:\Temp\logs
PS> rdownload-dir session-2 C:\Temp\loot C:\Temp\loot
PS> upload-dir ./payloads C:\Temp\payloads
PS> download-dir C:\Temp\logs ./logs
```

Remote session relay direction:

```powershell
# Active session -> another session
PS> rupload C:\Temp\payload.exe session-2 C:\Users\Public\payload.exe

# Another session -> active session
PS> rdownload session-2 C:\Users\Public\loot.zip C:\Temp\loot.zip
```

Autocomplete:

```powershell
PS> upl<Tab>
PS> upload ./pay<Tab>
```

The interactive prompt completes command names and local filesystem paths for local-source commands such as `upload`, `upload-dir`, `invoke-script`, and `execute-assembly`.

In-memory helpers:

```powershell
PS> invoke-script ./AdminTools.ps1
PS> execute-assembly ./tool.exe arg1 arg2
```

Reporting:

```powershell
PS> ad-info
PS> opsec-check
```
## Notes

- `execute-assembly` supports managed .NET assemblies only.
- `invoke-script` imports into the current remote runspace.
- `rupload`, `rdownload`, `rupload-dir`, and `rdownload-dir` do not write temporary files on the controller host, but the bytes still pass through controller memory and use two WinRM transfer legs.
- `ad-info` and `opsec-check` are read-only reporting commands.
- Some reporting data requires sufficient remote privileges.

<a href="https://www.buymeacoffee.com/blue0x1" target="_blank"><img src="https://www.buymeacoffee.com/assets/img/custom_images/orange_img.png" alt="Buy Me A Coffee" style="height: 41px !important;width: 174px !important;box-shadow: 0px 3px 2px 0px rgba(190, 190, 190, 0.5) !important;-webkit-box-shadow: 0px 3px 2px 0px rgba(190, 190, 190, 0.5) !important;" ></a>

## License

MIT. See [LICENSE](LICENSE).
