#!/usr/bin/env python3 """ WinRM version of recon script Demonstrates how to replace SSH-based scripts with Python WinRM """ import os import sys from winrm_executor import WinRMExecutor from pathlib import Path def main(): # Get connection details host = os.getenv('HOST', '192.168.88.108') username = os.getenv('USER_NAME', 'Admin') password = os.getenv('PASS', 'P@ssw0rd!') print(f"=== WinRM Reconnaissance: {username}@{host} ===") # Create WinRM executor executor = WinRMExecutor(host, username, password) try: # Test connection print("[*] Establishing WinRM connection...") if not executor.connect(): print("❌ Failed to establish WinRM connection") print("\nTroubleshooting:") print(" 1. Ensure target machine is powered on and reachable") print(" 2. Verify WinRM service is running: Get-Service WinRM") print(" 3. Check AllowUnencrypted setting: winrm get winrm/config/service") print(" 4. Verify firewall rules: Get-NetFirewallRule -DisplayGroup '*Remote Management*'") sys.exit(1) print("✅ WinRM connection established") # Execute recon script script_path = Path(__file__).parent / "../powershell/recon.ps1" if not script_path.exists(): print(f"❌ PowerShell script not found: {script_path}") sys.exit(1) print(f"[*] Executing reconnaissance script via WinRM...") print("=" * 60) success = executor.upload_and_execute_script(script_path) print("=" * 60) if success: print("🎉 Reconnaissance completed successfully via WinRM!") else: print("❌ Reconnaissance failed") sys.exit(1) finally: executor.close() if __name__ == "__main__": main()