CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// Remote access

Port 5985: WinRM (HTTP)

Windows Remote Management over HTTP, used by PowerShell Remoting. Messages are encrypted by Kerberos or NTLM, but the transport is HTTP.

Windows Remote ManagementPowerShell Remotingwsman
5985

How WinRM (HTTP) works

Remote access
terminal:5985Invoke-Command terminal:5985Invoke-Command

The client opens a session to port 5985: each command typed is sent to the server, which runs it and returns the output. Encryption is optional: traffic is only protected if TLS is enabled on the server and the client.

Transport
TCP · UDP
Exposure risk
8/10 high if reachable from the Internet
Encryption
Optional TLSTLS only if negotiated
IANA status
Assigned1 registered service
Range
Registered (1024-49151)
Category
Remote access
01 Security

Is port 5985 dangerous?

Common attacks and weaknesses

  • Remote command execution with any valid admin credentials.
  • Lateral movement (Evil-WinRM).
  • Brute force when exposed.

How to secure it

  • Restrict to admin subnets with host firewalls.
  • Prefer HTTPS (5986) and Just Enough Administration.
  • Log PowerShell activity (script block logging).
02 Registry

IANA registry entries for port 5985

ServicePortTransportDescriptionReferenceUpdated
wsman 5985 TCP, UDP WBEM WS-Management HTTP - 2006-11

// source: IANA service name and port number registry

03 Check it

Which program uses port 5985, and is it reachable?

Linux

sudo ss -ltnup 'sport = :5985'      # process listening on 5985
sudo lsof -nP -i :5985

macOS

sudo lsof -nP -i :5985

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 5985 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 5985
netstat -ano | findstr :5985

From another machine

nmap -p 5985 -sV <host>
sudo nmap -sU -p 5985 <host>
nc -zv <host> 5985

Block it in the firewall

sudo ufw deny 5985/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 5985" -Direction Inbound -LocalPort 5985 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 5985 used for?

Windows Remote Management over HTTP, used by PowerShell Remoting. Messages are encrypted by Kerberos or NTLM, but the transport is HTTP.

Is port 5985 TCP or UDP?

Port 5985 is registered for TCP and UDP. In practice the service mostly uses TCP.

Is it safe to open port 5985?

It is rated 8/10 (high) when exposed to the Internet. Remote command execution with any valid admin credentials. Restrict to admin subnets with host firewalls.

How do I check if port 5985 is open?

On Linux run "ss -ltnup 'sport = :5985'", on macOS "lsof -nP -i :5985", and on Windows "netstat -ano | findstr :5985" to see the local process. From another machine, "nmap -p 5985 <host>" shows whether it is reachable.

05 Related
:22 SSH tcp · udp · sctp · moderate risk :3389 RDP tcp · udp · critical risk :23 Telnet tcp · udp · critical risk :5900 VNC tcp · udp · critical risk :5986 WinRM (HTTPS) tcp · udp · high risk :10000 Webmin tcp · udp · high risk :89 SU/MIT Telnet Gateway tcp · udp :107 Remote Telnet Service tcp · udp

Latest vulnerability news

All news