1

Recently i was trying to research deeper into running remote commands from windows to windows. It can be easy with ssh, ftp - but I wanted it to run the commands without knowing the password either username, just local ip and computer name and maybe some opened firewall ports.

I used couple commands that some people suggested me to:

  • wmic
  • powershell remote commands
  • winrs
  • psexec

However some errors appeared and now i can't continue my work.

WMIC

When trying to run node wmic command this error often appeared

ERROR: 
Description = RPC server is unavailable

It happened every time when i was trying to run this command. I've even tested this on couple computers. Let me know if i have to use some setup commands on remote computer for this to work

Powershell

I've did everything microsoft docs said. Even though i didn't work. I've tried getting the ps session, entering it etc.

This is the command that i used for invoking a command:

Invoke-Command -ComputerName DHEB -ScriptBlock {Get-UICulture}

It executed this error:

[DHEB] Connecting to remote server DHEB failed with the following error message : WinRM cannot process the request.
The following error with errorcode 0x8009030e occurred while using Negotiate authentication: A specified logon session
does not exist. It may already have been terminated.
 Possible causes are:
  -The user name or password specified are invalid.
  -Kerberos is used when no authentication method and no user name are specified.
  -Kerberos accepts domain user names, but not local user names.
  -The Service Principal Name (SPN) for the remote computer name and port does not exist.
  -The client and remote computers are in different domains and there is no trust between the two domains.
 After checking for the above issues, try the following:
  -Check the Event Viewer for events related to authentication.
  -Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or
use HTTPS transport.
 Note that computers in the TrustedHosts list might not be authenticated.
   -For more information about WinRM configuration, run the following command: winrm help config. For more
information, see the about_Remote_Troubleshooting Help topic.
    + CategoryInfo          : OpenError: (DHEB:String) [], PSRemotingTransportException
    + FullyQualifiedErrorId : 1312,PSSessionStateBroken

WinRS

Winrs command also didn't turn out well. Desktop-VAPJUPI is online and winrs is installed on the pc. However it still didn't work

Command:

winrs -r:"DESKTOP-VAPJUPI" cmd.exe

Output:

Winrs error:
C:\Users\matis>The WinRM client cannot process the request. If the authentication scheme is different from Kerberos, or if the client computer is not joined to a domain, then HTTPS transport must be used or the destination machine must be added to the TrustedHosts configuration setting. Use winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. You can get more information about that by running the following command: winrm help config.

PsExec

The last command that i used is psexec. It is very stable and very useful, however it didn't work for me.

Command:

PsExec.exe \DESKTOP-VAPJUPI -e -i -nobanner cmd.exe

Output:

Couldn't access DESKTOP-VAPJUPI:
The network path was not found.

Make sure that the default admin$ share is enabled on DESKTOP-VAPJUPI.

I tried sharing whole C:\ disk on Desktop-VAPJUPI, but it still didn't work. Let me know how do I share the default for admin$

As you can see non of the commands worked. I don't know if I'm doing everything wrong either my pcs are retarted, or maybe the whole thing that i want to do is impossible.

And yes I know that I can setup anonymous login for ftp or ssh keys for passwordless login, however I don't want to do that for some reason.

Any answers are appreciated, thanks

dheb
  • 11
  • 1
  • 3
  • This is more about about config/usage, so it's not on-topic at SO. Try ServerFault instead. That being said, the `psexec` sample misses one backslash from UNC name. Also, are the computers in the same (or trusted) domains? – vonPryz Jan 03 '22 at 11:51
  • Most of them are designed to have an authentication of some kind. Are you realy trying to open up computers for any unauthorized access? Why not simply use a method where the credentials are delegated like Keberos. No need to enter them but not every body with acccess to the network can mess up everything? – T-Me Jan 03 '22 at 12:02
  • @T-Me Yeah i would like to open unauthorized access – dheb Jan 03 '22 at 12:36
  • @vonPryz Alright i will – dheb Jan 03 '22 at 12:37
  • I think we might have a [xy problem](https://meta.stackexchange.com/questions/66377/what-is-the-xy-problem/66378#66378) here. What do you want to achieve and why do you need it without credentials? What you are trying is highly dangerous and an invitation to every hacker... – T-Me Jan 03 '22 at 15:55
  • Don't worry. My goal is to create windows server machine that would check for a file (like a pass) in every pc that would enter my network – dheb Jan 03 '22 at 16:15

1 Answers1

0

Option 1:

     Invoke-Command -ComputerName DESKTOP-VAPJUPI -ScriptBlock {cmd.exe /c ipconfig /all}

Option 2:

     Enter-PSSession DESKTOP-VAPJUPIA
     cmd.exe /c ipconfig /all
     Exit-PSSession

However, you must be on the same domain/network and the user running the script must have the correct permissions on the remote computer. But this way you don't have to enter credenials when running the remote script.

RobertPS
  • 3
  • 3
  • All of 2 options are executing this error: `Enter-PSSession : Connecting to remote server dheb failed with the following error message : WinRM cannot process the request. The following error with errorcode 0x8009030e occurred while using Negotiate authentication: A specified logon session does not exist. It may already have been terminated.` I've tried checking if I have winrm installed, I also restarted it. I tried reseting the proxy and setting trusted hosts to my PC name. I don't know what's wrong – dheb Jan 03 '22 at 17:34
  • @dheb This will only work if `Enable-PSRemoting` has been executed on the PC and the User who executes this is admin on the PC. If they are in the same windows domain the argument `-Authentication Kerberos` can be added. (There are some more authentication methods that can be tested. ) – T-Me Jan 04 '22 at 07:58
  • Well it works, but it makes no sense for script. The project is supposed to work without any user integration – dheb Jan 04 '22 at 16:23