Common attacks and weaknesses
- Remote command execution with any valid admin credentials.
- Lateral movement (Evil-WinRM).
- Brute force when exposed.
Port 5985: WinRM (HTTP)
Windows Remote Management over HTTP, used by PowerShell Remoting. Messages are encrypted by Kerberos or NTLM, but the transport is HTTP.
5985
How WinRM (HTTP) works
Remote accessThe client opens a session to port 5985: each command typed is sent to the server, which runs it and returns the output. Encryption is optional: traffic is only protected if TLS is enabled on the server and the client.
- Transport
- TCP · UDP
- Exposure risk
- 8/10 high if reachable from the Internet
- Encryption
- Optional TLSTLS only if negotiated
- IANA status
- Assigned1 registered service
- Range
- Registered (1024-49151)
- Category
- Remote access
Is port 5985 dangerous?
How to secure it
- Restrict to admin subnets with host firewalls.
- Prefer HTTPS (5986) and Just Enough Administration.
- Log PowerShell activity (script block logging).
IANA registry entries for port 5985
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| wsman | 5985 | TCP, UDP | WBEM WS-Management HTTP | - | 2006-11 |
// source: IANA service name and port number registry
Which program uses port 5985, and is it reachable?
Linux
sudo ss -ltnup 'sport = :5985' # process listening on 5985
sudo lsof -nP -i :5985macOS
sudo lsof -nP -i :5985
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 5985 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 5985 netstat -ano | findstr :5985
From another machine
nmap -p 5985 -sV <host> sudo nmap -sU -p 5985 <host> nc -zv <host> 5985
Block it in the firewall
sudo ufw deny 5985/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 5985" -Direction Inbound -LocalPort 5985 -Protocol TCP -Action Block # Windows
What is port 5985 used for?
Windows Remote Management over HTTP, used by PowerShell Remoting. Messages are encrypted by Kerberos or NTLM, but the transport is HTTP.
Is port 5985 TCP or UDP?
Port 5985 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 5985?
It is rated 8/10 (high) when exposed to the Internet. Remote command execution with any valid admin credentials. Restrict to admin subnets with host firewalls.
How do I check if port 5985 is open?
On Linux run "ss -ltnup 'sport = :5985'", on macOS "lsof -nP -i :5985", and on Windows "netstat -ano | findstr :5985" to see the local process. From another machine, "nmap -p 5985 <host>" shows whether it is reachable.
Other remote access ports
:22 SSH tcp · udp · sctp · moderate risk :3389 RDP tcp · udp · critical risk :23 Telnet tcp · udp · critical risk :5900 VNC tcp · udp · critical risk :5986 WinRM (HTTPS) tcp · udp · high risk :10000 Webmin tcp · udp · high risk :89 SU/MIT Telnet Gateway tcp · udp :107 Remote Telnet Service tcp · udp