https://cybertoolchain.io/tools/evil-winrm-py New releases and features in evil-winrm-py, tracked by The Cyber Toolchain. en Sat, 12 Sep 2026 15:34:55 GMT https://github.com/adityatelange/evil-winrm-py/releases/tag/v1.7.0 https://github.com/adityatelange/evil-winrm-py/releases/tag/v1.7.0 Sat, 12 Sep 2026 15:34:55 GMT evil-winrm-py v1.7.0 adds an MCP server mode for AI agent access and JEA endpoint support via new CLI flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--mcp` flag to start evil-winrm-py as an MCP server in streamable HTTP mode, with `--mcp-host` (default `127.0.0.1`) and `--mcp-port` (default `8000`) to configure the listener address.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Exposes four MCP tools over the server: `winrm_login`, `winrm_execute`, `winrm_logout`, and `list_sessions`, supporting multiple concurrent WinRM sessions each tracked by a `session_id`. • Adds `-c`/`--configuration-name` CLI flag to connect to a constrained JEA endpoint instead of the default `Microsoft.PowerShell` full PowerShell session, available in both interactive shell and MCP server modes. • Remote tab-completion adapts to the commands available on the connected JEA endpoint, and menu commands unsupported under JEA are automatically disabled in the interactive shell. • Respects the `NO_COLOR` environment variable to suppress color output. • Makes `remote_path` optional in `upload` and `local_path` optional in `download` menu commands. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/evil-winrm-py https://github.com/adityatelange/evil-winrm-py/releases/tag/v1.6.0 https://github.com/adityatelange/evil-winrm-py/releases/tag/v1.6.0 Sat, 21 Mar 2026 13:05:39 GMT evil-winrm-py v1.6.0 adds runexe, loaddll, and services commands plus PowerShell tab completion. • Adds `runexe` command to upload and execute local executables on the remote host, with support for passing arguments. • Adds `loaddll` command to load a remote DLL as a PowerShell module. • Adds `services` command to list running non-system services on the remote machine. • Adds tab auto-completion for PowerShell cmdlets and aliases in the interactive shell. • Supports multiple encodings when reading PowerShell scripts loaded via `load_ps`. • Enables case-insensitive function name matching in `load_ps`. • Strips single quotes from paths when drag-and-dropping files for uploads/downloads. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/evil-winrm-py https://github.com/adityatelange/evil-winrm-py/releases/tag/v1.5.0 https://github.com/adityatelange/evil-winrm-py/releases/tag/v1.5.0 Sat, 06 Sep 2025 18:02:32 GMT evil-winrm-py v1.5.0 adds `runps` for local PowerShell script execution and tab completion for remote executables. • New `runps` command executes local PowerShell scripts directly from the interactive shell without pre-uploading. • Adds tab completion for executable files in the current remote directory, speeding up lateral movement workflows. • Improves Kerberos credential handling for compatibility with updated `gssapi` library. • Enhances `load_ps` to provide feedback and update command suggestions when new scripts are loaded. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/evil-winrm-py https://github.com/adityatelange/evil-winrm-py/releases/tag/v1.3.0 https://github.com/adityatelange/evil-winrm-py/releases/tag/v1.3.0 Sat, 02 Aug 2025 18:37:10 GMT evil-winrm-py v1.3.0 adds `loadps` to source local PowerShell scripts into remote sessions with smart tab completion. • New `loadps` command loads functions from a local `.ps1` script directly into the remote PowerShell session, with validation of file existence and extension before loading. • Functions loaded via `loadps` are automatically added to tab completion in the remote shell, making them instantly discoverable. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/evil-winrm-py https://github.com/adityatelange/evil-winrm-py/releases/tag/v1.2.0 https://github.com/adityatelange/evil-winrm-py/releases/tag/v1.2.0 Fri, 25 Jul 2025 15:35:53 GMT evil-winrm-py v1.2.0 adds a short `ewp` alias, customizable User-Agent header, and auto-defaulting Kerberos SPN prefix. • Adds `ewp` as a shorter entry-point alias alongside `evil-winrm-py` for faster invocation. • New `--user-agent` argument lets operators customize the WinRM client User-Agent string (defaults to the standard Microsoft WinRM Client value). • Automatically applies an `http` SPN prefix when none is supplied, reducing Kerberos 'Server not found in database' errors in Kerberos-authenticated sessions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/evil-winrm-py https://github.com/adityatelange/evil-winrm-py/releases/tag/v1.1.0 https://github.com/adityatelange/evil-winrm-py/releases/tag/v1.1.0 Fri, 13 Jun 2025 16:55:34 GMT evil-winrm-py v1.1.0 adds a --debug flag for enhanced debug logging. • Adds `--debug` flag for enhanced debug logging during WinRM sessions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/evil-winrm-py https://github.com/adityatelange/evil-winrm-py/releases/tag/v1.0.0 https://github.com/adityatelange/evil-winrm-py/releases/tag/v1.0.0 Sun, 01 Jun 2025 17:13:42 GMT evil-winrm-py v1.0.0: Python WinRM shell with NTLM, Pass-the-Hash, Kerberos, cert auth, and file transfer • New interactive shell for executing commands on remote Windows systems via WinRM. • Supports NTLM, Pass-the-Hash, Certificate, and Kerberos authentication methods. • Enables SSL-encrypted WinRM sessions for secure communications. • Supports file upload and download between local and remote Windows machines. • Includes tab completion for remote paths, command history, and colorized output. • Cross-platform: runs on both Windows and Linux. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/evil-winrm-py