Step 14. Remote Management — Commanding a Computer Across the Network

Level 0 — Understanding Computer Operation and Structure | Difficulty ★★★☆☆ | Estimated time 2 hours

Prerequisite: Step 13 complete. We will work in Windows PowerShell. Today is a conceptual-understanding chapter — hands-on remote-connection practice happens in Level 2, once a lab environment is in place.

• What you need: a Windows PC, PowerShell, Notepad (for the writing exercise in Section 3-6).
• Caution: today’s exercises only query your own computer’s state, so they are 100% safe. Just engrave one thing — practicing remote management only among your own computers in your own lab is an absolute rule of this book. Connecting to someone else’s computer without authorization is a crime, regardless of settings.

Corporate breach investigations often contain a twist. Examine the victim server’s logs, and the session that performed the malicious activity is recorded as having connected from another computer across the network. The intruder never sat in front of that server. How? The answer is simple — the attacker used the very same remote management features that administrators use every day. Today is the day we understand the structure of that "door."

1. Learning Objectives

By the end of this chapter, you will be able to:

• Explain what a remote session is, and the role and port numbers of WinRM/PSRemoting
• State the difference between Enter-PSSession and Invoke-Command
• Test whether a port (door) is open with Test-NetConnection and interpret the result
• Explain what lateral movement is and why legitimate management tools become its vehicle
• Produce a list of ports waiting (LISTENING) on your own computer

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

2-1. What a Remote Session Is

Until now, our PowerShell has been "a window inside my computer." A remote session stretches this window’s cable across the network and connects it to another computer’s PowerShell. Your screen stays the same, but the commands execute on that computer over there.

It’s like sitting at home, phoning your office computer, and saying "print those documents for me." Your hands are here; the work happens over there.

2-2. WinRM and PSRemoting — Windows’ Official Door

The official system that makes this possible on Windows is WinRM (Windows Remote Management), and the PowerShell-facing feature is called PSRemoting. It plays the same role as SSH on Linux (covered in Step 29).

Three important facts:

• WinRM opens doors (ports) and waits — port 5985 (plain) and 5986 (encrypted). A real example of the "address:port" idea from Step 6
• These doors are closed by default; to use them, the receiving computer must turn them on
• Connecting requires an account (ID/password) on the target computer — so that not just anyone can get in

2-3. Lateral Movement — The Attacker’s Sideways Walk

When an attacker first breaks into a corporate network, they usually take the weakest single machine (for example, the PC of an employee who opened a phishing email). But the prize (an important server) lies elsewhere. How do they get there?

From the compromised PC → to the PC next to it → to the next one → to the target server. This sideways walk is called lateral movement. And the means most frequently used for that movement are the remote management features — because they use legitimate functions already built into Windows rather than bringing hacking tools, detection is hard.

So the defender’s countermeasure is also fixed: record and monitor "who connected remotely, from where, to where." Step 12’s logs reappear here — remote logins are all left as events, after all.

2-4. Credentials — The Key That Opens the Door

What remote access ultimately requires is an account. So instead of breaking down the door, attackers steal the key (account information). Real breaches often proceed in the order: "password leaked → remote access with a legitimate account → recorded in logs as a normal login."

This is why password management is so emphasized, and why companies use separate administrator-only accounts — an isolation wall so that even if an everyday account falls to phishing, administrative rights don’t go with it. "Separate your privileges" — a recurring security design principle.

2-5. Why We Don’t Practice This Now

To actually try remote access, you need two computers: one that commands, one that receives. That’s why a "lab" is needed, and in Level 2 we’ll spin up several virtual machines and do it hands-on then. Today is the day to engrave in your mind: "this kind of door exists, it works like this, and that’s why it’s dangerous."

3. Follow Along

3-1. Meeting Enter-PSSession Through the Help System

PowerShell ships with a built-in manual. Let’s meet today’s star command through its help:

Get-Help Enter-PSSession

이름
    Enter-PSSession

개요
    Starts an interactive session with a remote computer.

구문
    Enter-PSSession [-ComputerName] <string> [-Credential <pscredential>] [-Port <int>] ...
    Enter-PSSession [[-Session] <PSSession>] ...
    ...

(Verified on 2026-09-09, partial excerpt. You can see the synopsis — "starts an interactive session with a remote computer" — and several usage forms.)

How to read it: the core form is this —

Enter-PSSession -ComputerName Server01 -Credential domainuser

"Open a remote session to the computer named Server01, with these credentials (account)." Once it runs, the prompt changes to something like [Server01]: PS>, and from then on every command you type executes on that computer over there.

Why do this: Get-Help is the tool you’ll reach for every time you meet an unfamiliar command from now on. A first-hand manual more accurate than an internet search already lives inside your computer. Add the -Examples option and it gathers up practical examples for you.

3-2. Invoke-Command — To Many Machines at Once

Let’s look at its cousin command:

Get-Help Invoke-Command -Examples

If Enter-PSSession is "converse with one machine," Invoke-Command is the command that sprays "the same command to many machines at once":

Invoke-Command -ComputerName S1, S2, S3 -ScriptBlock { Get-Service }

How to read it: "run Get-Service on the three machines S1, S2, S3, and gather the results for me." This is the method an administrator uses to check the patch status of hundreds of machines.

Re-reading through the attacker’s eyes: what if this convenience lands in an attacker’s hands? It becomes "deploying a malicious command to many internal machines simultaneously." Same tool, different intent — that sentence is today’s core.

3-3. Testing Whether a Door Is Open — Test-NetConnection

Let’s test whether my computer’s WinRM door (port 5985) is open:

Test-NetConnection localhost -Port 5985

ComputerName     : localhost
RemoteAddress    : ::1
RemotePort       : 5985
TcpTestSucceeded : False

(Verified on 2026-09-09.)

How to read the output: TcpTestSucceeded: False — "the connection test to that port failed = the door is closed." On most personal PCs, WinRM is off, so False is normal. If True appears, someone (or something) has left this door open — asking "why is this open?" is security awareness. (localhost is the agreed-upon name meaning "this computer itself.")

Predict this: would Test-NetConnection localhost -Port 443 (the web door) be True? (Answer: mostly False. It was False in our verification, too. That’s because 443 is the other party’s door, used when you connect to someone else’s web server — not a door your computer holds open. "The door I go out through" and "the door I hold open" are different — this distinction is the core of understanding ports.)

3-4. Viewing My Computer’s WinRM State

Get-Service WinRM | Select-Object Name, Status, StartType

Name  Status  StartType
----  ------  ---------
WinRM Stopped    Manual

(Verified on 2026-09-09.)

How to read it: WinRM operates as a service, true to its name (review of Steps 5 and 13). Stopped + Manual — off, and starts only when needed. The default for a personal PC.

A security-awareness question: what if you’ve never configured remote management, yet this service shows Running + Automatic? That’s an investigation point — "who turned this on, and why?" On a company PC the IT department may have enabled it; otherwise, it’s grounds for suspicion. Knowing the history of your settings is where security begins.

3-5. Our House’s Door List — LISTENING Ports

Bringing back Step 6’s netstat. This time we look only at ports in the "waiting" (LISTENING) state:

netstat -an | Select-String LISTENING | Select-Object -First 10

  TCP    0.0.0.0:22             0.0.0.0:0              LISTENING
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:2869           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:3450           0.0.0.0:0              LISTENING
  ...

(Verified on 2026-09-09.)

How to read the output: 0.0.0.0:portnumber + LISTENING means "currently accepting connections to this number on all network cards." An interpretation example from the verification computer: ports 135 and 445 are Windows defaults (RPC and file sharing), and 2869 is device discovery (UPnP). But look — port 22 is there. That’s SSH’s door. This computer has an OpenSSH server installed and running. If you remember installing it, normal; if not, an investigation point. If unknown numbers like 3450–3453 appear, you can trace "which process opened it" using Step 13’s techniques (advanced: Get-NetTCPConnection -State Listen | Select-Object LocalPort, OwningProcess).

Why do this: the goal is not to understand everything but to build the habit of listing how many doors our house has and where. Only with this list in hand can you spot "a door that differs from usual."

3-6. Organizing Your Thoughts — Writing One Paragraph

Today’s final exercise is not a command but writing. Open Notepad and write one paragraph answering this question in your own words:

"Why are remote management features (WinRM/PSRemoting) attractive to attackers?"

Hints: ① uses Windows’ built-in features with no additional tools to install (hard to detect), ② after compromising one machine, enables moving sideways with stolen accounts, ③ hard to distinguish from an administrator’s normal activity.

Why write it out: because the final verification of understanding is not execution but explanation. In interviews and in reports alike, this exact sentence gets used.

4. Missions & Exercises

Mission — An Inspection Checklist of My Computer’s Open Doors

Combine what you learned today into a checklist:

1. Check the result of Get-Service WinRM and record "on or off"
2. Test both Test-NetConnection localhost -Port 5985 and 5986, and record the results
3. Check the waiting ports with netstat -an | Select-String LISTENING
4. Gather all three into open-doors.txt, and on the last line write your answer to "Are there any open doors I don’t know about?"

Exercises

Question 1. What are the two ports WinRM waits on, and is this door’s default state open or closed?

Question 2. Explain the difference between Enter-PSSession and Invoke-Command, along with the situations where each is used.

Question 3. Give two or more reasons why an attacker would use legitimate features like WinRM instead of bothering to bring hacking tools.

Question 4. Answer practically: "If remote management is dangerous, why not just turn it all off?"

Get-Service WinRM | Select-Object Name, Status, StartType | Out-File open-doors.txt
Test-NetConnection localhost -Port 5985 -WarningAction SilentlyContinue |
  Format-List ComputerName, RemotePort, TcpTestSucceeded | Out-File open-doors.txt -Append
Test-NetConnection localhost -Port 5986 -WarningAction SilentlyContinue |
  Format-List ComputerName, RemotePort, TcpTestSucceeded | Out-File open-doors.txt -Append
netstat -an | Select-String LISTENING | Out-File open-doors.txt -Append
notepad open-doors.txt

WinRM: Stopped / Manual — 꺼져 있음. 내가 설정한 적 없으므로 정상
5985: False / 5986: False — 원격 관리 문 닫혀 있음
LISTENING: 22(SSH — 내가 아는가?), 135·445·2869(윈도우 기본), 3450~3453(확인 필요)
답: 22번과 3450번대는 내가 설치한 프로그램의 것인지 확인이 필요하다

6. Common Pitfalls & Fixes

Wall 1. "I can’t practice remote access right now"

Symptom: you have only one computer at home, so there’s no counterpart to test Enter-PSSession against.
Cause: remote practice requires at least two machines — a perfectly normal situation.
Fix: today is a concept chapter, so having no practice is correct. In Level 2 you’ll spin up several virtual machines and practice to your heart’s content. For now, the one-paragraph explanation in Section 3-6 stands in for the exercise.

Wall 2. Get-Help output is too long

Symptom: the help scrolls on for dozens of screens.
Cause: it’s a formal manual, so it contains everything.
Fix: look at just -Examples, or pinpoint a single parameter you’re curious about, like Get-Help command -Parameter ComputerName. A manual is not a book you read front to back — it’s a dictionary you look things up in.

Wall 3. Test-NetConnection results differ from the textbook

Symptom: the book says False, but my computer says True.
Cause: some program enabled WinRM, or — on a company PC — it may be on by management policy.
Fix: this is not a malfunction but a discovery. Trace "who turned it on" — ask the IT department if it’s a company PC; if it’s a personal PC and you have no memory of it, it becomes practice in investigating when it was enabled, using the techniques from Steps 11–13.

Wall 4. Port numbers won’t stick in memory

Symptom: you confuse 5985 with 5895.
Cause: you’re trying to memorize. Port numbers are not a memorization subject.
Fix: even practitioners look up port numbers. What matters is not the number but the structure: "each service has a designated door, and open doors are inspection targets." The numbers memorize themselves with use.

Wall 5. Too many LISTENING ports — it makes me anxious

Symptom: netstat shows a string of numbers you don’t know.
Cause: Windows holds several ports open by default (135, 445, etc.), and each installed program opens its own. The verification computer had more than ten.
Fix: don’t be anxious — make a list. The goal is not "determine whether everything is normal right now" but "secure the usual list, and notice when something changes." For unknown ports, trace the identity via OwningProcess → PID.

7. Summary

Today’s Concepts

Today’s Commands

A Sense That Matters More Than Commands

The door that is convenient for the administrator opens in exactly the same shape for an attacker holding stolen credentials. That is why recording and monitoring "who used this door" is the core of defense.

The security industry has an expression — "Living off the Land" — a technique of attacking using only the legitimate tools already present on the computer (PowerShell, WinRM), without bringing in malicious files. Abnormal use of normal files is hard for file-based antivirus to catch, which is why modern defense watches behavior — who ran what, when, and from where. The logs and lineage tracing you learned in Steps 12–13 are exactly the raw materials of that behavior-based defense.

And remote management is the first "perfect double-edged sword" you meet in this book. Turn it off and you can’t do your job; turn it on and it becomes the attacker’s road. Firewalls, encryption, access control… this dilemma will repeat across countless topics ahead, and each time the answer is not "off/on" but "control who uses it, when, and how." The paragraph you wrote today is the very language of judgment a security professional uses every day.

Once every box is checked, Step 14 is complete.