EIP-2026-119286

This Metasploit module exploits WinRM to achieve remote code execution on Windows systems using either PowerShell 2.0 or a VBS CmdStager. It authenticates via NTLM, uploads a malicious script, and executes it to deliver a payload.