evil-winrm-py

evil-winrm-py is a Python tool designed for remote command execution on Windows machines via WinRM (Windows Remote Management). It offers an interactive shell enhanced with features like file transfer capabilities, command history, and colorized output for better usability during penetration testing and red team operations.

The tool supports multiple authentication methods, including NTLM, Pass-the-Hash, Certificate, and Kerberos, making it versatile for various network environments and privilege escalation scenarios. It is particularly useful in post-exploitation phases where WinRM is enabled on target Windows systems.

As a Kali Linux package, it integrates seamlessly into offensive security workflows, providing a reliable alternative to native WinRM clients with added security testing features.

evil-winrm-py leverages the WinRM protocol over HTTP or HTTPS to establish sessions with remote Windows hosts. It uses python3-pypsrp for WS-Management protocol handling, supports NTLM/Kerberos authentication via python3-kerberos, and implements an interactive shell with prompt-toolkit for enhanced user experience. Features like file upload/download utilize WinRM's native transport, while options for hashes, certificates, and private keys enable advanced auth bypass techniques such as Pass-the-Hash.