Example PoC on how to configure WINRM and execute a remote powershell command on Windows

gistfile1.cs

// see PowerShell Remoting on Python at https://www.bloggingforlogging.com/2018/08/14/powershell-remoting-on-python/
// see https://github.com/jborean93/pypsrp

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

// NB you should add reference to C:\Program Files\Reference Assemblies\Microsoft\WindowsPowerShell\v1.0\System.Management.Automation.dll (this is installed by the Windows SDK).

using System.Management.Automation;
using System.Management.Automation.Runspaces;
using System.Security;

namespace RunRemoteCommands
{
    class Program
    {
        static void Main(string[] args)
        {
            RunScript();
        }

        // See Installation and Configuration for Windows Remote Management at http://msdn.microsoft.com/en-us/library/windows/desktop/aa384372(v=vs.85).aspx
        // See Three ways to configure WinRM listeners. http://blogs.msdn.com/b/wmi/archive/2009/03/17/three-ways-to-configure-winrm-listeners.aspx
        // See How to: View Certificates with the MMC Snap-in at http://msdn.microsoft.com/en-us/library/ms788967.aspx
        // See MakeCert at http://msdn.microsoft.com/en-us/library/windows/desktop/aa386968(v=vs.85).aspx
        //
        // Configure HTTP listener:
        //
        //  winrm create winrm/config/listener?Address=*+Transport=HTTP
        //
        // Try it:
        //
        // winrs -r:http://localhost:5985 dir
        //
        //
        // Create self-signed certificate (makecert comes from Windows SDK):
        //  makecert -r winrm.crt
        //
        //
        // Configure HTTPS listener:
        //
        //  winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname="HOST";CertificateThumbprint="XXXXXXXXXX"}

        // See How to Execute Remote PowerShell Commands using C# at http://scorpiotek.com/blog/?p=770

        // See WinRM (Windows Remote Management) Troubleshooting at http://blogs.technet.com/b/jonjor/archive/2009/01/09/winrm-windows-remote-management-troubleshooting.aspx
        //
        // C:\Users\rui.lopes> winrm id
        // IdentifyResponse
        //     ProtocolVersion = http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd
        //     ProductVendor = Microsoft Corporation
        //     ProductVersion = OS: 6.1.7601 SP: 1.0 Stack: 2.0
        //
        // See the configuration:
        //  winrm get winrm/config
        //
        // See configured listeners:
        //  winrm enumerate winrm/config/listener
        //
        // There is also a remote shell that uses winrm underneat, eg:
        //
        //  winrs -r:https://10.135.66.118:5986 dir
        public static string RunScript()
        {
           Runspace remoteRunspace = null;

            http://blogs.msdn.com/b/wmi/archive/2009/03/17/three-ways-to-configure-winrm-listeners.aspx

           openRunspace(
               "https://10.135.66.118:5985/wsman",
               "http://schemas.microsoft.com/powershell/Microsoft.PowerShell",
               @"domain\rui.lopes",
               "password",
               ref remoteRunspace
            );

            StringBuilder stringBuilder = new StringBuilder();
            using (PowerShell powershell = PowerShell.Create())
            {
                powershell.Runspace = remoteRunspace;
                powershell.AddCommand("get-process");
                powershell.Invoke();
                var results = powershell.Invoke();
                remoteRunspace.Close();
                foreach (PSObject obj in results)
                {
                    stringBuilder.AppendLine(obj.ToString());
                }
            }

            return stringBuilder.ToString();
         }

        public static void openRunspace(string uri, string schema, string username, string livePass, ref Runspace remoteRunspace)
        {
            System.Security.SecureString password = new System.Security.SecureString();
            foreach (char c in livePass.ToCharArray())
            {
                password.AppendChar(c);
            }
            PSCredential psc = new PSCredential(username, password);
            WSManConnectionInfo rri = new WSManConnectionInfo(new Uri(uri), schema, psc);
            //rri.AuthenticationMechanism = AuthenticationMechanism.Kerberos;
            rri.AuthenticationMechanism = AuthenticationMechanism.Negotiate;
            rri.ProxyAuthentication = AuthenticationMechanism.Negotiate;
            remoteRunspace = RunspaceFactory.CreateRunspace(rri);
            remoteRunspace.Open();
        }
    }
}