← Port Encyclopedia
5985
WinRM-HTTP
TCP
Windows
Critical Risk
WinRM HTTP — Windows remote management, PowerShell remoting, lateral movement
🔍 How to Scan Port 5985
nmap -sV -p 5985 target
nmap -sV -sC --script=banner -p 5985 target
nc -zv target 5985
🛡️ Security Considerations
- Scan port 5985 with
nmap -sVto identify the exact service and version - If WinRM-HTTP is not needed, close or firewall this port immediately
- Check for default credentials if a management interface runs on this port
- Use
searchsploit winrm-httpto find known exploits - Monitor traffic on port 5985 with Wireshark or tcpdump for anomalies
- Ensure the service is patched to the latest version to prevent known CVE exploitation