Study guide
20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others
Key Takeaways Explain This Topic AI
5.2 service discovery is matching the newly visible listener to a movement method: SMB/fileshares, RDP/VNC, SSH, LDAP, RPC/DCOM, FTP, Telnet, HTTP(S) admin UIs, LPD, JetDirect, WMI, and WinRM.
SMB is files and admin-share execution; RDP and VNC are interactive GUIs; SSH is the Linux and network-gear hop; Telnet and FTP are cleartext cousins that still show up on forgotten segments.
WinRM is HTTP(S) 5985/5986 PowerShell remoting; WMI is RPC/DCOM-style Windows management — they are not interchangeable with SSH or with Mimikatz.
LPD and JetDirect are forgotten printer paths; HTTP/HTTPS admin UIs (printers, cameras, iLO/iDRAC, hypervisors) are often the easiest hop on a newly visible net.
Process IDs tell you which process owns a listener and which process to target for 4.4 injection as you blend in; they are not CVSS scores and not a 5.3 exfil channel.
Last updated: August 2026
The rest of the 5.2 matching drill is which remote service you use once the hop exists. CompTIA lists service discovery targets: SMB/fileshares , RDP/VNC , SSH , cleartext , LDAP , RPC , FTP , Telnet , HTTP/HTTPS web interfaces , LPD , JetDirect , RPC/DCOM , and process IDs , then calls out WMI and WinRM on their own. You already know these ports from Domain 2. 5.2 is not a second port-memorization quiz. It is: this listener is how I move . This guide names the protocol and the job. It will not give exploit payloads, pass-the-hash one-liners, or WinRM shell recipes.
SMB and fileshares
SMB (typically TCP 445, historically 139) is how Windows hosts share files and how many testers copy a tool then execute it. Fileshares are both a loot path and a movement path: C$ and ADMIN$ admin shares, department shares with a scripts folder, and the share the jump box already mounts. When you pick SMB: the stem shows 445 open on the next host, an admin share the foothold account can write, or a file copy followed by remote execution. When you do not: the only listener is 3389 and the job is an interactive desktop (that is RDP), or 5985 and the job is a PowerShell remoting shell (that is WinRM).
Exam trap: treating every share as 2.2 share enumeration. 2.2 found the share. 5.2 uses it to land on the next box. Trap two: calling SMB the same thing as 4.2 NTLM relay. Relay borrowed a live authentication. Here you already have a credential (or a hash you will reuse as 4.3) and you are speaking SMB as a client from the new position.
RDP and VNC: interactive GUIs
RDP (TCP 3389) is Windows interactive desktop. VNC (often TCP 5900, plus vendor variants) is the cross-platform GUI cousin, frequently with weaker authentication and older encryption. When you pick RDP: you need a GUI, a logged-on user session, or a jump-host pattern the administrators already use. When you pick VNC: the stem is a non-Windows HMI, a lab PC, or a camera/NVR that speaks RFB. Exam trap: answering SSH for a Windows GUI stem, or answering RDP for Linux. Trap two: treating VNC as encrypted because the operator used it on a trusted VLAN. VNC is often cleartext or weakly protected , which is why CompTIA groups it with RDP but also with the cleartext idea.
RDP is loud in a different way than SMB. Interactive logons create sessions defenders can see. If the stem emphasizes stealthy file copy and a service-style command, SMB or WMI/WinRM is a better match than parking an RDP desktop.
SSH, Telnet, FTP, and the cleartext umbrella
SSH (TCP 22) is the Linux, Unix, and network-gear hop: interactive shell, file copy, and — conceptually — a later tunnel. When you pick SSH: the next host is Linux, an appliance, or a switch, and 22 is the admin path. Telnet (TCP 23) is the cleartext remote shell that still sits on printers, legacy controllers, and forgotten lab gear. FTP (TCP 21) is file movement, often with cleartext USER/PASS. CompTIA's cleartext bullet is the umbrella: Telnet, FTP, HTTP (not HTTPS), SNMPv1/v2c community strings, and similar. When you pick cleartext: the stem shows credentials or commands on the wire, or a service that never offered TLS. Exam trap: encrypting Telnet in your head because the OT VLAN felt private. Private is not encrypted. Trap two: answering SSH whenever the host is Linux. Linux with Telnet enabled is still Telnet.
LDAP, RPC, and RPC/DCOM
LDAP (389/636) from a new position is directory enumeration you could not see before: more accounts, more groups, more service principals. 5.2 LDAP is not 4.3 LDAP injection. Injection tampers with a filter. Here you are a bindable client on a segment that can reach a domain controller or an LDAP-speaking appliance.
RPC and RPC/DCOM (endpoint mapper on TCP 135, then dynamic ports) are how a lot of Windows remote management still works: MMC snap-ins against a remote computer, DCOM activation, and the transport under WMI . When you pick RPC/DCOM: the stem is remote Windows management that is not WinRM 5985/5986 and not a simple file share. Exam trap: calling every Windows remote job SMB. File copy is SMB. A WMI process create or a remote Event Viewer snap-in is RPC/DCOM.
HTTP/HTTPS admin UIs, LPD, and JetDirect
HTTP/HTTPS web interfaces are the forgotten admin planes: printer dashboards, camera and NVR logins, iLO/iDRAC/iRMC hypervisor and lights-out boards, SAN web UIs, and the internal wiki nobody put behind SSO. After a pivot they are often the easiest hop because they still have default credentials (4.2) or a password you just found with findstr. When you pick the web UI: the stem is a browser admin page on the newly visible net, not a file share and not SSH.
LPD (Line Printer Daemon, TCP 515) and JetDirect (HP printer language, often TCP 9100) are CompTIA's named printer paths . Printers sit on every VLAN, they are rarely patched, they store jobs and sometimes credentials, and they may have a second interface or a management VLAN the tester was not supposed to see. When you pick them: the stem is a printer, print server, or HP JetDirect banner on a segment you just reached. When you do not: treating LPD as Linux SUID privilege escalation, or treating JetDirect as VLAN hopping. They are lateral service discovery targets — forgotten, in-scope if the RoE includes them, and useful because nobody watches 9100 the way they watch 3389.
Exam trap: skipping printers because they are not domain controllers. 5.2 lists them because they are how testers stumble into credentials and adjacent networks. Trap two: attacking the vendor's cloud print service because the printer phones home. Stay on the in-scope device.
WMI and WinRM: two Windows remoting planes
WMI (Windows Management Instrumentation) queries and steers Windows over RPC/DCOM . Conceptually: remote process create, remote inventory, scheduled-job style actions, and a lot of living-off-the-land admin work. WinRM (Windows Remote Management) is HTTP(S) on 5985/5986 and is the transport under PowerShell remoting. Objective 4.4 named Evil-WinRM as a WinRM shell tool . 5.2 names WinRM as the protocol you move with .
When you pick WMI: 135/RPC is open, WinRM is filtered, or the stem is a WMI query or process create. When you pick WinRM: 5985 or 5986 is the path, and the job is an interactive or semi-interactive PowerShell remoting session. Exam trap: answering SSH for WinRM because both are remoting. Trap two: answering Mimikatz for WMI because both are Windows. Mimikatz dumps credentials (4.4 / additional 5.2 dump). WMI uses a credential to manage a host. Trap three: treating WinRM as only HTTPS 5986. HTTP 5985 is common inside a domain and is still WinRM.
Process IDs: who owns the listener, what you inject into
Process IDs (PIDs) are listed under 5.2 service discovery because movement is process-aware. A listening port is owned by a PID. That PID tells you whether you are looking at lsass.exe , spoolsv.exe , winlogon.exe , an HMI binary, or a vendor backup agent. Two exam jobs:
Targeting the service. You talk to the process that actually speaks SMB, RDP, or the admin UI — not a random high port.
Targeting injection (cross-ref 4.4). Process injection and hollowing hide code inside a trusted name. 5.2 is where you identify the PID worth blending into as you move; 4.4 is the injection attack type . Exam trap: treating PIDs as CVSS scores (4.1) or as a 5.3 exfiltration channel. A PID is not how you sneak a file out. Trap two: killing a PID to disable EDR and calling that 5.2. Circumventing security tools is 4.4 and RoE-gated.
Worked protocol match
From WS-042's OT NIC the tester sees: 445/SMB on FILE-OT , 3389/RDP on HMI-01 , 5900/VNC on a lab PC, 22/SSH on a jump appliance, 23/Telnet on a PLC, 21/FTP on a legacy historian, 389/LDAP toward a DC that this NIC can now reach, 135/RPC on a Windows engineering workstation, 80 on a printer, 515/LPD and 9100/JetDirect on the same printer, 5985/WinRM on ENG-WS , and an HTTPS iDRAC. SMB is the file-and-admin-share hop to FILE-OT. RDP is the interactive HMI. VNC is the lab GUI. SSH is the appliance. Telnet and FTP are cleartext . LDAP is new directory visibility, not LDAP injection. RPC/DCOM and WMI are how you manage the engineering workstation if WinRM is off; WinRM is the answer when 5985 is the open admin port. The printer HTTP UI plus LPD/JetDirect are forgotten paths, not a domain-controller substitute. PID inventory on ENG-WS shows which process owns 5985 and which trusted process would be a 4.4 injection target later. Match the listener to the movement method; do not invent a kernel exploit because OT felt exotic.
Service Typical picture Movement job Exam trap
SMB / fileshares TCP 445; C$ / ADMIN$ / department shares Copy and execute; loot scripts Calling it 2.2 enum only, or 4.2 NTLM relay
- RDP TCP 3389 Windows GUI Interactive desktop hop Answering SSH for a Windows GUI
- VNC Often 5900; weaker GUI Non-Windows or lab desktop Assuming it is encrypted
- SSH TCP 22 Linux / appliance / gear hop Answering SSH for every Linux host that still has Telnet
Telnet / FTP / cleartext 23 / 21 / HTTP / SNMPv1 Credentials and shells on the wire Treating private VLAN as encryption
- LDAP 389/636 Directory from the new position 4.3 LDAP injection
- RPC / DCOM 135 + dynamic MMC, DCOM, WMI transport Calling every Windows remote job SMB
- HTTP(S) admin UIs Printers, cameras, iLO/iDRAC Browser admin hop Skipping them as out of scope by default
- LPD / JetDirect 515 / 9100 printers Forgotten print-path hop LPD as Linux SUID; JetDirect as VLAN hopping
- WMI RPC/DCOM Windows management Query / process create Mimikatz; SSH
- WinRM 5985/5986 PowerShell remoting Windows remoting shell SSH; only-5986
- Process IDs Owner of a listener Service targeting; 4.4 injection target CVSS; 5.3 exfil
Sequence on the exam: name the newly visible listener, name the movement method, and do not pick a 4.2/4.3/4.4 attack type when the stem is simply which protocol carries you to the next host.