5985

Port 5985/tcp is registered with IANA as wsman with the description "WBEM WS-Management HTTP," assignee and contact "[Jim_Davis]," a Registration Date of 2006-11, and a blank reference field — and it is dual-registered on both TCP and UDP (identical name, description, assignee, and date on each). In practice, 5985 is overwhelmingly Microsoft's Windows Remote Management (WinRM), the Windows implementation of the WS-Management (WS-Man) SOAP-over-HTTP protocol, and it carries the plaintext HTTP variant of that transport. WinRM on 5985 is the default channel for PowerShell Remoting (Enter-PSSession, Invoke-Command, New-PSSession), for remote WMI/CIM management, and for agentless configuration tools such as Ansible's winrm connection plugin. Its encrypted companion is 5986/tcp, which carries WinRM over HTTPS (TLS). WinRM is enabled with winrm quickconfig or Enable-PSRemoting and is common on Windows Server and on managed Windows 10/11 workstations. For an analyst, 5985 is a significant post-compromise and lateral-movement surface: it is a well-known target for credential attacks and remote command execution inside enterprise networks, and because 5985 is plaintext HTTP, an on-path or coercion attacker can intercept or relay NTLM authentication (mitm6/Responder-style relaying) when NTLM auth is permitted and the traffic is not otherwise protected. A notable historical exposure is CVE-2021-31166 (Microsoft, disclosed May 11, 2021; CVSSv3 9.8), a remote pre-authentication use-after-free in the HTTP.sys stack that also affected the WinRM service on 5985 for Windows 10 / Server versions 2004 and 20H2, with wormable DoS-to-RCE potential; researchers at disclosure cited internet-scan data of roughly two million reachable WinRM systems. Standard guidance is to keep WinRM bound to internal/VPN networks rather than exposing 5985 to the internet, and to prefer 5986 (HTTPS) with certificate-based authentication.

IANA assignment

wsman — "WBEM WS-Management HTTP"; reference (blank — no RFC cited in the cached IANA registry); assignee/contact "[Jim_Davis]"; Registration Date 2006-11; dual-registered 5985/tcp + 5985/udp

[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry rows 10208 (tcp) & 10209 (udp)

Range class

registered (1024–49151) [Confirmed] — port number 5985 falls in the IANA registered range

Related ports

5986/tcp (WinRM over HTTPS); 135/tcp (RPC/DCOM, alternate WMI transport); 445/tcp (SMB, lateral movement)

Primary use

Windows Remote Management (WinRM) over HTTP — the Microsoft WS-Management (WS-Man/SOAP-over-HTTP) transport; default channel for PowerShell Remoting and remote WMI/CIM [Confirmed] — https://learn.microsoft.com/en-us/answers/questions/1196102/how-to-enable-port-5985-in-winrm-service ; https://book.hacktricks.xyz/network-services-pentesting/5985-5986-pentesting-winrm

Common software

built into Windows (WinRM service; enabled via winrm quickconfig / Enable-PSRemoting); consumed by PowerShell Remoting, WMI/CIM cmdlets, and Ansible's winrm connection plugin for agentless Windows management

Security implications

high-value lateral-movement / credential-attack target; plaintext HTTP allows NTLM interception/relay (mitm6/Responder-style) when NTLM auth is permitted; CVE-2021-31166 (HTTP.sys UAF, CVSSv3 9.8, disclosed 2021-05-11) affected WinRM on 5985 for Windows 10 / Server 2004 & 20H2 with wormable DoS-to-RCE potential [Likely] — https://securityaffairs.com/118189/security/cve-2021-31166-windows-http-flaw.html ; https://www.bleepingcomputer.com/news/security/wormable-windows-http-vulnerability-also-affects-winrm-servers/ ; https://www.rapid7.com/blog/post/ra-cve-2021-31166-analysis/

Typically seen on

Windows Server and managed Windows 10/11 workstations with PowerShell Remoting / WinRM enabled

Companion port

5986/tcp carries the HTTPS (TLS-encrypted) WinRM variant; 5985 carries plaintext HTTP [Confirmed] — https://www.verylazytech.com/winrm-port-5985-5986

Analyst note

internet-exposed 5985 is high-risk; prefer 5986 (HTTPS) with certificate-based auth and keep WinRM on internal/VPN networks.

Port 5985/udp is registered with IANA as wsman with the description "WBEM WS-Management HTTP," contact Jim Davis, and a registration date of 2006-11 (month precision only — the IANA registry records no day, and the Reference field is blank). The registration is a paired entry: 5985/tcp carries the identical service name, description, assignee, contact, and registration date, which is IANA's common practice of reserving both transports for one service name even when only one is used in deployment. In real-world networks, 5985 is best known as the WinRM (Windows Remote Management) HTTP port — Microsoft's implementation of the DMTF WS-Management standard and the transport underlying PowerShell Remoting (Enter-PSSession, Invoke-Command) and automation tooling such as Ansible's winrm connection plugin. Crucially, every documented WinRM/WS-Management deployment operates over HTTP (TCP), with 5985 carrying plaintext HTTP and 5986 carrying HTTPS; no source describes a live WS-Management service actually listening on UDP/5985. The UDP registration therefore appears to be a reserved companion to the TCP entry rather than a description of observed traffic. Because the practical service is TCP, the well-documented security posture — an authenticated WinRM session yields a full remote PowerShell shell, making 5985/tcp a well-known lateral-movement and remote-code-execution target hunted by tools like evil-winrm and crackmapexec — belongs to the TCP variant. For 5985/udp specifically, no port-specific exposure or scanning statistics were located, so live UDP usage and its exposure profile remain Unknown and should not be asserted.

IANA assignment

wsman — "WBEM WS-Management HTTP"; contact Jim Davis; registration date 2006-11 (month precision); Reference field blank (no RFC cited) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (local snapshot the IANA Service Name and Transport Protocol Port Number Registry; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5985)

Range class

registered/user (1024–49151)

Dual registration

5985/tcp is registered with the identical service name, description, contact, and 2006-11 date — a paired TCP/UDP reservation [Confirmed] — IANA registry snapshot

Primary use

5985 is the WinRM (Windows Remote Management) HTTP port — Microsoft's WS-Management implementation and the transport for PowerShell Remoting; 5985 = HTTP (plaintext), 5986 = HTTPS

Common software

WinRM service; PowerShell Remoting; Ansible winrm plugin; pentest tools (evil-winrm, crackmapexec) all target the TCP service on this port number — no UDP software identified

Security implications (TCP counterpart)

an authenticated WinRM session grants a full remote PowerShell shell; 5985/tcp is a well-known lateral-movement / RCE target and appears in internet-wide scan datasets. Internet-facing exposure is treated as high-risk

UDP actual usage

No documented live WS-Management/WinRM service on UDP; all real-world deployment is TCP/HTTP. UDP registration appears reserved/paired, not observed [Likely] — inference from absence of UDP documentation; Microsoft Learn and IANA

UDP-specific exposure/scanning data

no port-5985/udp-specific host counts, honeypot data, or writeups found [Unknown]

Analyst note

Treat 5985/udp as a formally registered but not-observed-in-practice paired entry; the substantive service, PowerShell Remoting, and lateral-movement risk live on 5985/tcp. Do not assert active UDP/5985 usage or scanning.